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UNITED STATES v. LIN (2019) 


U.S. Navy-Marine Corps Court of Criminal Appeals. 

UNITED STATES, Appellee v. Edward C. LIN, Lieutenant Commander (0-4), U.S. Navy, Appellant 
No. 201700303 

Decided: April 15, 2019 

Before WOODARD, HUTCHISON, and CRISFIELD, Appellate Military Judges. 


For Appellant: Larry Younger, Esq.; Captain Thomas R. Fricton, USMC. For Appellee: Major Kelli A. 
Oneil, USMC; Captain Brian L. Farrell, USMC. 


PUBLISHED OPINION OF THE COURT 


The appellant was convicted, consistent with his pleas, of three specifications of violating a lawful general 
order, two specifications of making false official statements, and two specifications of willfully 
communicating information relative to the national defense of the United States to a person not entitled to 
receive it, in violation of Articles 92, 107, and 134, Uniform Code of Military Justice (UCMJ), 10 U.S.C. §§ 892, 
907, and 934.2 


On appeal, the appellant raises three assignments of error: (1) he was denied his right to a speedy trial as 
required by Article 10, UCMJ; (2) the military judge abused his discretion by admitting into evidence as 
aggravation damages caused by his misconduct that were hypothetical in nature; and (3) his sentence was 
inappropriately severe. Although not raised by the parties, we find that the Court-Martial Order (CMO) contains 
error and direct corrective action in our decretal paragraph. After careful consideration of the entire record, we 
find no merit in the assigned errors and affirm the findings and sentence. 


|. Background 


On 11 September 2015, as the appellant was about to board a flight from Honolulu to the People’s Republic of 
China, agents from the Naval Criminal Investigative Service (NCIS) and the Federal Bureau of Investigation 
(FBI) arrested the appellant. At the time of his arrest, the appellant had been the subject of a fifteen-month- 
long counterintelligence investigation. Prior to attempting to board his China-bound flight, law enforcement 
officers discovered that the appellant had concealed his true destination from his command by completing a 
false leave request form indicating that he would be traveling to Alexandria, Virginia, his home of record. 


The counterintelligence investigation also revealed that this was not the first time the appellant concealed 
foreign travel from his command. In October 2013, after requesting and receiving leave to travel to Alexandria, 
Virginia, the appellant instead traveled to Taiwan. Prior to traveling to Taiwan, the appellant had arranged to 
meet with a senior Taiwanese military officer and several other Taiwanese officers of lesser rank. 


Upon being taken into custody, the appellant was questioned, amongst other things, about his planned 
activities in China. Over the course of two days of questioning, which was recorded by law enforcement, he 
explained that he planned to meet a local national female, whom he had met on an online dating site and 
whom he knew to be a Chinese government employee. 


The appellant also admitted that, despite not disclosing them to his command security officer, he had close 


relationships with several foreign persons, including several registered foreign agents and some he believed to 


be foreign agents. He corresponded and conversed with these foreign agents about United States policy and 
positions. He was particularly open in his communications with two women with whom he conversed. With 
these women, he shared classified information concerning operational plans, policies, missions, and 
capabilities of the United States military. 


Unbeknownst to the appellant, one of the women he believed to be a foreign agent and with whom he 
communicated and shared classified information was actually an undercover United States law enforcement 
counterintelligence agent. As part of the investigation, the undercover agent recorded approximately 10 hours 
of conversations with the appellant, a substantial portion in Mandarin Chinese. 


The appellant's mishandling of classified information, however, was not limited to his discussions with these 
women. He also mishandled classified documents. While returning on a commercial flight from a deployment 
in February 2015, the appellant placed classified materials in his checked bags. A Department of Homeland 
Security officer found the classified documents while conducting an inspection of the appellant’s checked 
luggage and confronted the appellant about the documents. The appellant admitted to failing to maintain 
proper security of the classified documents, asked the officer to dispose of the documents, and left the 


Legal Professionals v 


Blogs 


[a]> 


s 


Welcome to FindLaw's Cases 
& Codes 


A free source of state and federal court 
opinions, state laws, and the United 
States Code. For more information about 
the legal concepts addressed by these 
cases and statutes visit FindLaw's Learn 
About the Law. 


Go to Learn About the Law > 


UNITED STATES v. LIN (2019) 
Docket No: No. 201700303 


Decided: April 15, 2019 


Court: U.S. Navy-Marine Corps Court of 
Criminal Appeals. 


Need to find an attorney? 
Search our directory by legal issue 
Enter information in one or both fields (Required) 


Legal issue 


I need help near (city, ZIP code or country) 


Atlanta, Georgia o 


For Legal Professionals 


> Practice Management 
> Legal Technology. 
> Law Students 


6 


documents with the officer. The appellant admitted that he did not know whether the officer had the required 
clearance to view or possess the classified documents. The appellant failed to inform his command of this 
compromise of classified documents. Additionally, classified materials were also discovered at the appellant's 
home during a search. 


The appellant was placed into pretrial confinement on 11 September 2015, the day he was apprehended 
attempting to board a flight to China. Following his apprehension, the appellant spent 249 days in pretrial 
confinement before his arraignment, and a total of 630 days before his sentence was announced. Additional 
facts necessary for the resolution of the issues raised will be discussed below. 


ll. Discussion 
A. Speedy Trial 


At trial, the appellant filed a motion to dismiss with prejudice the charges against him due to the government's 
violation of his Rule for Courts-Martial (R.c.m.) 707, Manual for Courts-Martial, United States (2016 ed.) and 
Article 10, UCMJ, right to a speedy trial. Finding that the govemment had complied with the requirements of 
both R.C.M. 707 and Article 10, UCMJ, the military judge denied the appellant's motion to dismiss. In denying 
the motion, the military judge issued a 19-page written ruling addressing his essential findings of fact and 
conclusions of law. On appeal, the appellant again asserts that the government violated his Article 10, UCMJ, 
right to a speedy trial by failing to exercise reasonable diligence to bring him to trial following his arrest.3 
However, unlike his complaint at trial where he argued the government's lack of diligence only extended to the 
date of his arraignment, on appeal he now asserts that the government's lack of diligence extended to the 
date his sentence was announced. We conclude that the government was diligent in bringing the appellant to 
trial and that the appellant's unconditional guilty plea waived any post-arraignment speedy trial violation claim. 


The appellant's guilty plea was unconditional. Generally, an unconditional guilty plea “waives any speedy trial 
issue as to that offense.” R.C.M. 707(e); see United States v. Tippit, 65 M.J. 69, 75 (C.A.A.F. 2007). However, 
Article 10, UCMJ, “provides a narrow exception to the normal rule that a speedy trial motion is waived by an 
unconditional guilty plea.” Id. (citing United States v. Mizgala, 61 M.J. 122, 126 (C.A.A.F. 2005)). A speedy trial 
claim under Article 10, UCMJ, is not waived by a subsequent guilty plea when an appellant litigates that claim 
at trial. Id. at 127. 


Article 10, UCMJ, provides: 


When any person subject to this chapter is placed in arrest or confinement prior to trial, immediate steps shall 
be taken to inform him of the specific wrong of which he is accused and to try him or to dismiss the charges 
and release him. 


Whether the appellant's Article 10, UCMJ, right to a speedy trial has been violated is a question of law we 
review de novo, “giving substantial deference to a military judge's findings of fact that will be reversed only if 
they are clearly erroneous.” Mizgala, 61 M.J. at 127 (citing United States v. Cooper, 58 M.J. 54, 57-59 (C.A.A.F. 
2003); United States v. Doty, 51 M.J. 464, 465 (C.A.A.F. 1999)) 


1. Waiver of post-arraignment claim 


At trial, the appellant focused his unsuccessful speedy trial claim on the period of time from his arrest to 
arraignment—11 September 2015 to 17 May 2016—and did not later reassert his claim based on any post- 
arraignment delay before entering his unconditional guilty plea. Although it is well-settled law that the 
government's speedy trial obligations do not terminate at arraignment, Cooper, 58 M.J. at 61, as an initial 
matter, we first consider whether the appellant limited his claim at trial to just pre-arraignment delay. If he did, 
then we must determine if by doing so, he waived appellate review of any new Article 10, UCMJ, claims 
attacking the government's lack of diligence post-arraignment. 


We find the appellant limited his Article 10, UCMJ, claim at trial to the period of time between his arrest and 
his arraignment. In accordance with the agreed upon Trial Management Order, the appellant filed his motion to 
dismiss on speedy trial grounds on 26 June 2016. The motion was litigated on 9 August 2016. During the 
proceedings on the motion, the military judge correctly noted that the “Article 10 concern runs to the date of 
trial, not merely to arraignment." When questioned by the military judge whether the defense had any post- 
arraignment speedy trial concerns, the appellant's defense counsel stated that he did not have any speedy trial 
concerns post-arraignment.® The defense counsel also acknowledged that the defense had not previously 
voiced any objection to any post-arraignment excludable delay granted.” And he acknowledged that the 
defense “could renew [the Article 10, UCMJ,] motion . if we have new evidence of . delay or lack of due 
diligence on the part of the government in proceeding to trial. | don’t have that at this time.” On 12 August 
2016, the military judge rendered his written ruling denying the speedy trial motion. In his ruling the military 
judge specifically found that the appellant had limited the motion to the time between apprehension and 
arraignment.? At no time following the issuance of the military judge's ruling did the appellant make any 
further speedy trial violation claims prior to the adjournment of his court-martial. 


As stated by the court in Mizgala, an appellant's unconditional guilty plea does not waive “his right to contest 
the military judge’s denial of his Article 10 motion on appeal.” Mizgala, 61 M.J. at 127 (emphasis added). 
Further, as this court has previously opined, Mizgala stands for the proposition that only those Article 10, 
UCMJ, issues litigated at trial survive a waiver stemming from an unconditional guilty plea. United States v. 
Dubouchet, 63 M.J. 586, 588 (N.-M. Ct. Crim. App. 2006). Here, by raising it and litigating it at trial, the 
appellant's Article 10, UCMJ, speedy trial claim preserved for appellate review was his pre-arraignment claim. 
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By failing to raise or litigate his newly asserted post-arraignment speedy trial claims at trial, we conclude that 
appellant's unconditional guilty plea has, like it did in Dubouchet, waived appellate review of that issue. See id. 
Accordingly, we will focus our review on the Article 10, UCMJ, speedy trial violation claim made by the 
appellant and denied by the military judge at trial, and analyze the appellant's claim under the factors 
articulated in Barker v. Wingo, 407 U.S. 514, 92 S.Ct. 2182, 33 L.Ed.2d 101 (1972). 


2. Barker analysis of preserved pre-arraignment claim of error 


When an accused is in pretrial confinement, Article 10, UCMJ, does not demand “constant motion,” but does 
impose on the government the standard of “reasonable diligence in bringing the charges [lodged against him 
or her] to trial.” Mizgala, 61 M.J. at 127 (citation omitted). In assessing whether the government has acted 
with “reasonable diligence in proceeding to trial,” our superior court has held that the four factors identified by 
the Supreme Court in Barker “are an apt structure for examining the facts and circumstances surrounding an 
alleged Article 10 violation.” Mizgala, 61 M.J. at 127 (citations omitted). The four Barker factors are: “(1) the 
length of delay; (2) the reasons for the delay; (3) whether appellant made a demand for a speedy trial; and (4) 
prejudice to the appellant.” United States v. Schuber, 70 M.J. 181, 188 (C.A.A.F. 2011) (citation omitted). 


Upon review, we find the military judge's findings of fact in support of his decision denying the appellant's 
Article 10, UCMJ, speedy trial claim are supported by the record, not clearly erroneous, and we adopt them as 
our own, !2 


a. Length of delay 


The initial question is whether the 249-day delay between the initiation of the appellant's pretrial confinement 
and his arraignment was unreasonable. In determining how Barker's first factor affects our inquiry, “we 
consider the particular circumstances of the [appellant's] case because ‘the delay that can be tolerated for an 
ordinary street crime is considerably less’” than that which can be tolerated for more serious, complex cases. 
United States v. Cooley, 75 M.J. 247, 260 (C.A.A.F. 2016) (quoting Barker, 407 U.S. at 531, 92 S.Ct. 2182). The 
length of the delay has been described by our superior court as a “triggering mechanism” for a speedy trial 
review and can be dispositive. Cooley, 75 M.J. at 260 (citing United States v. Cossio, 64 M.J. 254, 257 (C.A.A.F. 
2007)). When determining whether the length of delay is reasonable, the analysis: 


“is not meant to be a Barker analysis within a Barker analysis,” but should include the seriousness of the 
offense, the complexity of the case, the availability of proof, and “additional circumstances including] whether 
Appellant was informed of the accusations against him, whether the [glovernment complied with procedures 
relating to pretrial confinement, and whether the [glovernment was responsive to requests for reconsideration 
of pretrial confinement.” 


Cooley, 75 M.J. at 260 (quoting Schuber, 70 M.J. at 188) (citing Barker, 407 U.S. at 530-31, 531 n.31, 92 S.Ct. 
2182). 


In conducting our Barker analysis, “we remain mindful that we are looking at the proceeding as a whole and 
not mere speed: ‘The essential ingredient is orderly expedition and not mere speed.’” Mizgala, 61 M.J. at 129 
(quoting United States v. Mason, 45 C.M.R. 163, 167 (C.M.A. 1972)). “[U]nless there is a period of delay that 
appears, on its face, to be unreasonable under the circumstances, there is no necessity for inquiry into the 
other factors that go into the balance.” Schuber, 70 M.J. at 188. 


Here, we conclude 249 days between the initiation of the appellant's confinement and his arraignment is 
beyond what we would normally expect for a general court-martial and is sufficient to trigger analysis of the 
remaining Barker factors. However, under the circumstances of the appellant's case, we find that this period of 
delay was not unreasonable. 


The appellant's case involved extremely serious crimes, with very sensitive and complex evidentiary concerns. 
The appellant was charged with two specifications of espionage—one of the most serious crimes under the 
UCMJ as made evident by its maximum punishment of death. Further, when the appellant was placed into 
pretrial confinement, he was informed of the accusations against him, and the government complied with all 
pretrial confinement procedures. Additionally, although the appellant waived his right to be present at his 
pretrial confinement hearing, when the appellant requested reconsideration of his pretrial confinement status, 
the government was responsive to his request. 


b. Reasons for the delay 


Under the second factor in the Barker analysis, “different weights should be assigned to different reasons” 
articulated for the delay. Cooley, 75 M.J. at 260 (citing Barker, 407 U.S. at 531, 92 S.Ct. 2182). Deliberate 
attempts by the government to delay the proceedings in order to hamper the defense weigh heavily against 
the government. Id. In analyzing the reasons for delay, we also acknowledge that the government “has the 
right (if not the obligation) to thoroughly investigate a case before proceeding to trial.” Cossio, 64 M.J. at 258 
(citations omitted). In contrast, delay caused by the defense weighs against the appellant. Cooley, 75 M.J. at 
260 (citing Vermont v. Brillon, 556 U.S. 81, 90, 129 S.Ct. 1283, 173 L.Ed.2d 231 (2009)). In appellant's case, the 
reasons for delay are consistent with the timeline adopted by the military judge and not objected to by the 
parties at trial. 1! 


The investigation of the appellant's case did not end when he was placed into pretrial confinement. In this 
case, due to the circumstances and timing of the appellant's apprehension, the government had large 
amounts of information to gather and process in order to determine what charges the evidence supported. 
Gathering the evidence, in turn, involved multiple foreign contacts. It required the translation and transcription 


of several conversations conducted in Mandarin Chinese. It involved coordination with and between multiple 
federal law enforcement and intelligence agencies. And it was necessary to consult with numerous federal 
authorities to precisely determine what information disclosed by the appellant was classified, at what level it 
was Classified, and whether any privilege would be exercised over the information. The interviews with the 
appellant on 11 and 12 September 2015 generated 13 hours of potentially classified content. The potentially 
classified content was sent to 12 separate Original Classification Authorities (OCAs) for review to determine 
whether the information was actually classified; if classified, its classification level; and, to provide the 
information's stakeholders an opportunity to exercise any privilege over the classified information. 
Coordinating with these 12 OCAs continued from October 2015 until 6 January 2016. 


During this same timeframe, law enforcement was translating and identifying potential classified information 
contained within the 10 hours of recorded conversations between the appellant and the undercover agent—the 
most recent of which had occurred just days prior to the appellant's arrest. Potentially classified portions of 
the conversations were then sent to two OCAs for a classification review and an opportunity to exert a claim 
of privilege over any information determined to be classified. The prosecutors for the appellant's case did not 
receive the transcripts of the conversations or the results of the OCAs’ classification reviews and privilege 
decisions until 5 November 2015. Charges were preferred one week later—12 November 2015.12 


Meanwhile, on 3 November 2015 the appellant hired his first civilian defense counsel (CDC). The following day, 
the government provided the appellant's CDC with the information necessary for her to request the interim 
security clearances required before she could review the classified evidence in the case. However, the CDC did 
not submit the documentation required to process her security clearance request until 24 November. On 1 
December 2015, the government notified the defense of its intent to conduct an Article 32, UCMJ, preliminary 
hearing within the next few weeks. The following day, the appellant's CDC notified the government that the 
appellant would not waive her presence at the Article 32, UCMJ, proceeding and informed the government that 
the appellant was asserting his rights to a speedy trial under R.C.M. 707. One week later, the CDC's requested 
security clearance was denied. 


The appellant then hired his second CDC on 11 December 2015. The government again promptly provided the 
second CDC the Information necessary to apply for an interim clearance, which was granted on 5 January 
2016.13 In the meantime, the appellant and his detailed defense counsel were granted access to review, 
subject to a protective order, the classified evidence against him on 15 December 2015. The second CDC 
received his final clearances and was authorized access to the classified evidence on 2 March 2016. 


On 7 March 2016, the appellant requested that the Article 32, UCMJ, proceedings which had been ordered by 
the CA to take place not later than 23 March 2016 be delayed until at least 30 March 2016. At the further 
request of the defense, the proceedings were ultimately delayed until 8 April 2016.14 The Article 32, UCMJ, 
preliminary hearing officer issued his report on 26 April 2016 and the appellant’s charges were referred to 
general court-martial on 10 May 2016. The appellant then requested and the military judge approved a delay 
of his arraignment from 13 May until 17 May 2016. The appellant was arraigned on 17 May 2016. 


Upon consideration of the reasons for delay, we find no evidence in the record that the government acted in 
bad faith or with malice in the processing of the appellant's case. We find the reasons for the delay here are 
reasonable, especially considering that the vast majority of the pre-arraignment delay in the appellant's case 
was either at his request, or to obtain the security clearances and authorization necessary to allow his CDC 
access to the classified evidence in order to defend him. This factor weighs against the appellant. 


c. Appellant's assertion of speedy trial right 


Under the third Barker factor, “[t]he defendant's assertion of his speedy trial right . is entitled to strong 
evidentiary weight in determining whether the defendant is deprived of the right.” United States v. Wilson, 72 
M.J. 347, 353 (C.A.A.F. 2013) (quoting United States v. Johnson, 17 M.J. 255, 259 (C.M.A. 1984)). 


The appellant made a single speedy trial request. This request was made by his first CDC on 9 November 
2015. Despite the request being couched in the terms of R.C.M. 707, we, like the military judge below, have 
considered this request to operate not only as an assertion of the appellant's right to a speedy trial under 
R.C.M. 707, but also Article 10, UCMJ.15 


The weight of the appellant's speedy trial request, however, is undercut by his subsequent requests for delay. 
For example, following his CDC’s authorization to review the classified evidence, the appellant requested a 30- 
day delay of the Article 32, UCMJ, proceeding, and a delay of the arraignment. Nevertheless, because the 
appellant did make a request for speedy trial, this factor weighs in favor of the appellant—albeit ever so 
slightly when considered in light of the appellant's own repeated requests for delay.'® 


d. Prejudice 


The final Barker factor is prejudice to the appellant due to the delay. Pre-trial confinement by itself does not 
constitute per se prejudice. Cooley, 75 M.J. at 262 (internal citations omitted). Instead, prejudice is assessed 
in light of the interests of the appellant which the speedy trial right was designed to protect. Barker, 407 U.S. at 
532, 92 S.Ct. 2182. Jurisprudence has recognized three such interests relevant to prejudice analysis: (1) 
prevention of oppressive pretrial incarceration; (2) minimization of anxiety and concern of the accused 
awaiting trial; and (3) limitation of the possibility that the defense will be impaired. Mizgala 61 M.J. at 129 
(citing Barker, 407 U.S. at 532, 92 S.Ct. 2182). “Of these, the most serious is the last, because the inability of a 
defendant adequately to prepare his case skews the fairness of the entire system.” Id. 


J 


The appellant argues that he was prejudiced by being subjected to oppressive pretrial incarceration, not being 
able to fully or as actively participate in his defense, and by losing the ability to secure the testimony of several 
foreign national witnesses who could have exonerated him or provided mitigating evidence during his 
sentencing proceeding. We conclude otherwise. 


On the whole of the record, we find for the following reasons that the appellant was not materially prejudiced 
by the delay. 


First, even though we acknowledge that the military judge awarded an additional 16 days of confinement 
credit for Article 13, UCMJ, violations,!7 when considering the totality of the conditions of the appellant's 
pretrial confinement we find them to be neither harsh nor oppressive. 


Second, we are unconvinced that the delay Impacted the appellant's ability to secure the testimony of the 
foreign national witnesses. The appellant voluntarily pleaded guilty to the offenses of which he was convicted. 
Prior to conducting the guilty plea inquiry, the military judge explained to the appellant that by pleading guilty 
he was giving up his right to a trial of the facts by court-martial—that is, his right to have the court-martial 
decide whether or not he was guilty of the offenses based upon the evidence presented by the government 
and, if he chose to do so, any evidence he may present. The appellant agreed to give up this right. During the 
sentencing proceeding, the appellant affirmed to the military judge that his ability to provide the court with any 
information that he desired to present on the issue of determining an appropriate sentence in his case had not 
been limited. Additionally, the record establishes the delay associated with securing the testimony of the 
foreign national witnesses occurred after the appellant was arraigned and that the delay was incurred at the 
appellant's request. Our review of the record provides no indication that the appellant's preparation for trial, 
defense evidence, sentencing strategy, or ability to present sentencing witnesses were compromised by the 
delay. 


Finally, as the vast majority of the pre-arraignment delay was attributable to providing his counsel of choice 
access to the classified evidence against him, and providing his counsel with the time they desired to 
adequately review the evidence and prepare his defense, the delay tended to benefit—rather than prejudice— 
the appellant. Balancing the factors identified in assessing prejudice, we find that if there was any prejudice to 
the appellant as a result of the pre-arraignment delay, it was minimal. This factor also weighs against the 
appellant. 


Accordingly, we conclude that the appellant was not denied his right to a speedy trial. The government was 
reasonably diligent in bringing the appellant to trial in accordance with the requirements of Article 10, UCMJ. 


B. Admission of Evidence in Aggravation was Proper 


During the pre-sentencing proceeding, the government called witnesses who testified about the harm to 
national defense posed by the appellant’s unauthorized disclosures of classified information.!® At trial, the 
appellant objected to the testimony as improper evidence in aggravation, arguing the evidence was 
speculative. Finding that the testimony was proper evidence in aggravation, the military judge admitted the 
testimony. The appellant avers that the military judge abused his discretion by admitting this testimony as 
aggravation of his crimes. We disagree. 


We review a military judge's decision to admit sentencing evidence under the abuse of discretion standard. 
United States v. Stephens, 67 M.J. 233, 235 (C.A.A.F. 2009). At sentencing, “trial counsel may present 
evidence as to any aggravating circumstances directly relating to or resulting from the offenses of which the 
accused has been found guilty.” R.C.M. 1001(b)(4) (emphasis added). R.C.M. 1001(b)(4), however, poses a 
higher burden than mere relevance. United States v. Hardison, 64 M.J. 279, 281 (C.A.A.F. 2007). 


Even if the evidence is directly related to or resulting from the offenses of which the appellant is convicted, the 
evidence will only be admitted if it also meets the requirements of Military Rule of Evidence (Mil. R. Evid.) 403, 
Manual for Courts-Martial, United States (2016 ed.). United States v. Manns, 54 M.J. 164, 166 (C.A.A.F. 2000). 
“A military judge enjoys ‘wide discretion’ in applying Mil. R. Evid. 403." Id. (citing United States v. Rust, 41 M.J. 
472, 478 (C.A.A.F. 1995)). If the military judge conducts a proper Mil. R. Evid. 403 balancing test, the “ruling 
will not be overturned unless there is a ‘clear abuse of discretion.’ ” Id. (citing United States v. Ruppel, 49 M.J. 
247, 250 (C.A.A.F. 1998)). When a military judge places his or her analysis on the record, we accord them the 
largest measure of deference. We afford judges less deference if they fail to articulate their analysis, and no 
deference if they fail to conduct a balancing at all. Id. 


Because the military judge did not conduct an Mil. R. Evid. 403 balancing, we give his decision no deference 
and have examined the record ourselves. The aggravating "harm to the national defense” evidence presented 
and objected to by the appellant was the same harm admitted to by the appellant during his providence 
inquiry. In short, the harm described was not just directly related to or resulting from an offense for which the 
appellant was convicted; rather the evidence of the harm posed by the disclosures is what made the 
appellant's disclosures of the information criminally punishable. The objected-to evidence directly supported 
an element of the appellant's 18 U.S.C. § 793(d) offenses—that the appellant had reason to believe that the 
information could be used to the injury of the United States or the advantage of a foreign nation.!9 Further, the 
evidence showed why the appellant had reason to believe that the information he admitted to disclosing could 
be used to injure the United States.2° Having reviewed the objected-to testimony, we find that the military 
judge appropriately determined that the testimony was proper evidence in aggravation in that it was directly 
related to his 18 U.S.C. § 793(d) convictions and provided the military judge with an informed explanation of 
how the disclosures injured the national defense interests of the United States. 
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The probative value of the objected-to testimony described above was not substantially outweighed by any 
prejudicial effect. Here, the potential prejudice to the appellant was that the military judge would sentence him 
based on a harm that had not actually been proven to have occurred—that the disclosed information had 
actually been received by a potential adversary of the United States. We are confident that the military judge 
appropriately limited his consideration of this evidence. “Military judges are presumed to know the law and to 
follow it absent clear evidence to the contrary.” United States v. Rodriguez, 60 M.J. 87, 90 (C.A.A.F. 2004) 
(citation omitted). There is no evidence in the record to indicate that the military judge rendered a sentence 
that was based upon any unproven harm to the national defense interests of the United States. To the 
contrary, when overruling the appellant's objection to the harm evidence, the military judge repeatedly 
announced that, absent evidence to the contrary, although the information disclosed could be used to the 
injury of the United States or the advantage of a foreign nation, he would not presume that the injury or 
advantage had actually occurred. Accordingly, we find the military judge did not abuse his discretion in 
admitting the testimony.2" 


C. Sentence Appropriateness 


The appellant next avers that his adjudged sentence was inappropriately severe given his strong case in 
extenuation and mitigation, and when compared to other cases involving the mishandling of classified 
information. We disagree. 


We review de novo the appropriateness of sentences. United States v. Lane, 64 M.J. 1, 2 (C.A.A.F. 2006). We 
will only affirm a sentence, or such part of a sentence, that we determine should be approved on the basis of 
the entire record. Art. 66, UCMJ. Our assessment of the appropriateness of a sentence requires an 
“individualized consideration of the particular accused on the basis of the nature and seriousness of the 
offense and the character of the offender.” United States v. Snelling, 14 M.J. 267, 268 (C.M.A. 1982) (citation 
and internal quotation marks omitted). A sentence is appropriate when justice is done and “the accused gets 
the punishment he deserves.” United States v. Key, 71 M.J. 566, 573 (N.-M. Ct. Crim. App. 2012) (citing United 
States v. Healy, 26 M.J. 394, 395 (C.M.A. 1988)). Despite our significant discretion in reviewing the 
appropriateness and severity of an adjudged sentence, we cannot engage in acts of clemency. United States 
v. Nerad, 69 M.J. 138, 146 (C.A.A.F. 2010). 


1. Case in extenuation and mitigation 


The appellant argues that the evidence he presented during the pre-sentencing proceeding was not 
appropriately considered by the military judge. He asserts that the evidence he presented demonstrates that 
he did not intend to harm the United States when he provided national defense information to those he knew 
or believed to be foreign agents, nor did he do It for personal enrichment. He also highlights his strong 
professional record consisting of competitive assignments over an 18-year career, the actions he performed in 
the furtherance of protecting of our national defense interests, his openness with investigators, and his 
ultimate decision to plead guilty. 


Like the military judge below, we too have considered the appellant's extensive case in extenuation and 
mitigation. However, weighing against the appellant's otherwise commendable service and conduct is the 
seriousness of his misconduct which included providing classified information to foreign agents and those he 
believed to be foreign agents, falsifying his leave requests, and mishandling classified documents. 


The maximum sentence the appellant faced as a result of his convictions was confinement for 36 years, 
forfeiture of all pay and allowance, and dismissal from the Navy. Having given individualized consideration to 
the appellant, the nature and seriousness of his offenses, his character, record of service, and all other matters 
contained in the record of trial, we find that the adjudged and approved sentence in this case of nine years’ 
confinement is appropriate. We are convinced that justice was done and the appellant received the 
punishment he deserved. Healy, 26 M.J. at 395. 


2. Closely related and disparate? 


The appellant also complains that when compared to similar cases, his sentence was inappropriately severe. 
We disagree. Each “court-martial is free to impose any [legal] sentence it considers fair and just.” United 
States v. Turner, 34 C.M.R. 215, 217 (C.M.A. 1964). Therefore, “[t]he military system must be prepared to 
accept some disparity . provided each military accused is sentenced as an individual.” United States v. Durant, 
55 M.J. 258, 261 (C.A.A.F. 2001) (discussing disparity in sentencing of codefendants) (citations omitted). In 
execution of this highly discretionary function, Article 66, UCMJ, does not require us to consider sentences in 
other cases, except when those cases are “closely related.” United States v. Ballard, 20 M.J. 282, 283 (C.M.A. 
1985); United States v. Noble, 50 M.J. 293, 294 (C.A.A.F. 1999); United States v. Wacha, 55 M.J. 266, 267 
(C.A.A.F. 2001). As a general rule “sentence appropriateness should be determined without reference to or 
comparison with the sentences received by other offenders.” Ballard, 20 M.J. at 283 (citations omitted). 
Notably, one narrow exception to this general principle of non-comparison exists. We are “required . ‘to engage 
in sentence comparison with specific cases . in those rare instances in which sentence appropriateness can 
be fairly determined only by reference to disparate sentences adjudged in closely related cases.’” Wacha, 55 
M.J. at 267 (citations omitted) (emphasis in original). 


When requesting relief by way of this exception, an appellant's burden is twofold: the appellant must 
demonstrate “that any cited cases are ‘closely related’ to his or her case and that the sentences are ‘highly 
disparate.’ " United States v. Lacy, 50 M.J. 286, 288 (C.A.A.F. 1999). If the appellant succeeds on both prongs, 
then the burden shifts to the government to “show that there is a rational basis for the disparity.” Id. 


For cases to be considered closely related, “the cases must Involve offenses that are similar in both nature 
and seriousness or which arise from a common scheme or design.” United States v. Kelly, 40 M.J. 558, 570 
(N.M.C.M.R. 1994). This threshold requirement can be satisfied by evidence of “co[-Jactors involved in a 
common crime, servicemembers involved in a common or parallel scheme, or some other direct nexus 
between the servicemembers whose sentences are sought to be compared.” Lacy, 50 M.J. at 288. 


In this case, the appellant's request for sentence comparison and relief is based on his assertion that his 
sentence violates the principle of general sentence uniformity. In support of his argument, he cites to 
numerous cases of servicemembers who were convicted of mishandling or disclosing classified information 
and received lesser sentences. Having reviewed the cases cited by the appellant, we do not find them closely 
related. The cases did not involve co-actors of the appellant. Nor do the cases cited involve offenses that are 
similar in both nature and seriousness to the appellant's or involve a common or parallel scheme. 


Having failed to meet his initial burden of showing that his case is closely related to any of the cases he cites, 
we decline his invitation to engage in sentence comparison. 


D. CMO Error 


Our review of the record has revealed that the results of the appellant's proceedings are not accurately 
reflected in the CMO. An appellant is entitled to an official record accurately reflecting the results of his 
proceedings. United States v. Crumpley, 49 M.J. 538, 539 (N.-M. Ct. Crim. App. 1998). We test error in CMOs 
under a harmless-error standard. Id. 


Ata minimum, a CMO must contain the following information: (1) the type of court-martial and the convening 
command; (2) a summary of all charges and specifications on which the appellant was arraigned; (3) the 
appellant's pleas; (4) the findings or disposition of all charges and specifications on which the appellant was 
arraigned; (5) if adjudged, the sentence; and (6) a summary of the action taken by the CA in the case. R.C.M. 
1114(c)(1) (emphasis added). 


Although not raised by the parties, we note that the court-martial order incorrectly fails to reflect that the 
appellant was arraigned on Charge |, Specification 2, and Charge III, Specification 1 as listed on the charge 
sheet, and entered pleas of not guilty to these offenses.22 Following his entry of pleas, Charge |, Specification 
2 was later dismissed with prejudice by order of the court 23 and Charge III, Specification 1 was withdrawn and 
dismissed without prejudice by the convening authority.24 The failure to reflect these offenses, the appellant's 
plea of not guilty to them, and their ultimate disposition in the CMO was error; however, the error was 
harmless as it did not materially prejudice the appellant's substantial rights. To ensure the appellant has an 
Official record which accurately reflects his proceedings, in our decretal paragraph we will order that the 
supplemental CMO reflect the information omitted. 


IIl. CONCLUSION 


After careful consideration of the record and briefs of appellate counsel, we have determined that the 
approved findings and sentence are correct in law and fact and that no error materially prejudicial to 
appellant's substantial rights occurred. Art. 59 and 66, UCMJ. Accordingly, the findings and sentence as 
approved by the convening authority are AFFIRMED. The supplemental CMO shall reflect all charges and 
specifications to which the appellant entered pleas and the final disposition of those offenses. 


FOOTNOTES 


2. The two Article 134, UCMJ, specifications of willfully communicating information relative to the national 
defense of the United States were charged as violations of 18 U.S.C. § 793(d). 


3. On appeal, the appellant does not raise any error related to the military judge's R.C.M 707 ruling. 
4. See Record at 704. 


5. Record at 363-25. We note that due to the many classified proceedings in this case that the trial 
transcript page numbering system often involved a hyphenated page numbering format. 


6 Id. at 363-25. 
Z Id. at 363-23, 
8. Id. at 363-26. 
9. AELIVat15. 
10. See AE LIV. 
11. See AE LIV at 7-9. 


12. The CA approved as R.C.M. 707 excludable delay the period of 12 September 2015 through 4 November 
2015 in order to “identify the appropriate agencies for classification reviews, to determine the security 
classification of evidence, and to allow stakeholders time to assert any privilege after completion of the 
classification reviews.” AE LIV at 4. The military judge found that the CA did not abuse his discretion in 
approving the 12 September 2015 through 4 November 2015 R.C.M. 707 excludable delay. Id. at 15. 


an 13. The CA approved as second period of R.C.M. 707 from 5 November 2015 through 5 January 2015 in 


order to allow the processing of and action on the CDC's request for interim security clearances. AE LIV at 6. 
At trial the appellant acknowledged and did not challenge that this period of delay was appropriately excluded 
under R.C.M. 707. Id. at 6-7. 


14. In conjunction with approving the request to delay the Article 32, UCMJ, proceedings until 8 April 2016, 
the CA also granted R.C.M. 707 excludable delay from 23 March 2016 through 8 April 2016. Id. at 9. 


15. See AELIV at 17-18. 


16. Even though we have determined that the appellant waived any post-arraignment claim of an Article 10, 
UCMJ, violation, looking beyond the arraignment. the record establishes that the appellant was not actively 
seeking a speedy trial. In August 2016, the defense requested a continuance to pursue letters rogatory to the 
Republic of Taiwan. After conducting an inquiry with the appellant to ensure that he understood the 
implications of and agreed with the requested delay—at the time estimated to be at least four and a half 
months—the military judge granted the requested continuance. He did so despite the government's assertion 
that it was ready to go to trial. Some six months later in February 2017, the appellant requested another two- 
month continuance of trial. Despite the government again asserting that it was ready to go to trial, after 
conducting an inquiry with the appellant to ensure that he understood the implications of and agreed with the 
requested delay, the military judge granted the continuance. 


17. See AE CXXXIII. 


18. Dueto the classified nature of the testimony, the specific facts testified to by the witnesses will not be 
discussed. 


19. See Record at 1147-47 and 1147-53. 
20. Seeld. at 1147-44 and 1147-55 to 56. 


21. Even if we were to assume that the military judge erred in admitting the testimony, adhering to the 
principles set forth by our superior court in United States v. Sales, 22 M.J. 305 (C.A.A.F. 1986) and United 
States v. Winckelmann, 73 M.J. 11 (C.A.A.F. 2013), we are confident that we could reassess the appellant's 
sentence to obviate the impact of the error. United States v. Moffeit, 63 M.J. 40, 41 (C.A.A.F. 2006). Based 
upon our review of the record, absent the witness's testimony we would reassess the appellant's sentence to 
be that which he received at trial—confinement for 9 years, forfeiture of all pay and allowance, and a dismissal. 


22. Following the disposition of these offenses, the military judge renumbered the remaining specifications 
under the respective charges. Although it is not error to do so, this practice often results in erroneous CMOs. 
Based upon our review of cases containing CMO errors, we note that it is often the renumbering of the 
remaining charges and specifications which ultimately leads to offenses, pleas entered to those offense, and 
the disposition of those offense being erroneously omitted from the CMO. To avoid these oft repeated CMO 
errors, we suggest that the practice which best ensures record Clarity and accuracy is to refrain from 
renumbering the charges or specifications following the entry of pleas. 


23. See Record at 367; AE LVII. 
24. See Record at 423. 
WOODARD, Chief Judge: 


Senior Judge HUTCHISON and Judge CRISFIELD concur. 
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nationalism, Lin and his parents would have found themselves with no other 
‘properly Chinese’ country to identify with other than the PRC. Lin and his parents 
likely consider themselves to be a Chinese family, but Taiwan is now Taiwanese, not 
Chinese. 
and corresponding hearsay under this says Lin's family emigrated from China 
and then had Lin, ..Hearsay around this case also says his father was once 
suspected of spying. 
np.reddit.com/r/taiwan/comments/4e8avb/taiwan_borm_naval_officer_charge 
d_with_espionage/dly4cdq 


According to a 2008 Navy release on a naturalization ceremony at which he 
spoke, “Lin was 14 years old when he and his family left Taiwan. They had to 
travel halfway around the world, stopping in different countries along the 
way.” https://news.usni.org/2016/04/10/u-s-naval-flight-officer-It-cmdr- 
edward-lin-accused-of-giving-u-s-secrets-to-china 


6d OC Reply Ñ Shore ~ 


@) GukeSkywalker - Sy ago 
China doesn't “hate” Taiwan, they feel frustrated at US for getting in between. And most 
the propaganda for money reasons. You sound like a Chinese/Taiwanese trying play the 
game. 


G1 QI Reply Ñ Share ~ 


@ entortunate won -£ 255 
It wouldn't have been so bad of it was just a standard P-3 squadron, but VPU-2? He's fucked. 
© Q2% Q Repy Ñ Shae ~ 
q [deleted] + 8y ago 
Exact same thoughts when | read this. 
Gad Q Reply Ñ She ~ 
e Shit box_ + 8y 390 
7 Most people outside VP don't grasp what VPU is... He should get hung. 
O G7 Q Reply Ñ She ~ 
« eddiexmercury » 8y 390 
Can you explain a bit? 
© Pap QI Rey Ñ She ~ 
e GATOR7862 - 8y əgo 


Not on Reddit. Let's just put it this way: VPU doesn't wear patches outside of 
the US. 


Gud Reply Ñ She ~ 

@ tater - oro 205 
it's UFOs, anybody in this thread who's acting like a secretive know-it-all knob 
about it is probably in on it and has likely committed crimes against humanity 
Qop Reply Ñ Share 


21 @ rran -s 


I agree, the man is so screwed! 
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G3 O Reply Ñ Shae -~ 


- 
@ [deleted] + 8y ago + Edited 8y ago 


O ug Reply Ñ Share 
(&) LeavenworthPowerTop + 8y ago + Edited 8y ago 
See, that's what l'm fucking talking about! 
+1 
© ıs% OReply Ñ Share 
(8) rattendemen - 8y 20 


Name checks out. +1! 


T7 Q Repy Ñ She ~ 


© LeavenworthPowerTop + 3y ego + Edited Sy ego 
Oh shit, look, that Officer has a purty mouth! 


Lube it up, for Leavenworth, Mr. Lin! 
O P9 Reply Ñ Share 
© outcastt51 - Sy ego 
Fuck prison, put one behind his ear 
O 70 Rey Ñ She ~ 
@ eremortnpowertop -© -> 
Much agreed. He can be my new fish, in the meantime, however. 
I can pimp him out. sell him for cigarettes and the like. 
This video helps demonstrate how we'll break him in and tell him his new name is 
“Bridgette” That '78 version is no-joke, either. 
Teo ORepy Ñ Shae ~ 
@ Sillyboosters + 3y 290 
We haven't executed anyone for espionage since what, ww2? | doubt this shitbag 
gets it. 
O Qag Reply Ñ Shae ~ 
1950's. The Rosenbergs were the last ones, | think. 
© 5% Reply Ñ Share 
q [deleted] + 8y ago 
The sad thing is they were just the tip of the iceberg. We basically let the 
Soviets have the bomb. 
© Qep Reply & Share 


O Allfather «Smo ego 


Dumb comment that ignores that open collaboration is the only 
reason we finished the bomb first in the first place 


If we had fewer idiots gatekeeping secrets because they're 
threatened by people who know more than them, then the world 
would be a better place 


21 Q Reply Ñ Share 


D. 
Hang his ass! 

© Qep Reply & Share 
~ [deleted] + 8y ago 


It would be fun to take him out on a ship (on a bread and water diet the whole time of 
course) and tie and up and make him walk the plank into the ocean. 


ad OC Reply Ñ Share 


- 
@ [deleted] + 8y ago 


He got top secret +, even though he moved from Taiwan when he was 14 and speaks fluent 
mandarin? Ok... who approved that? 


O Gnd Reply Ñ She ~ 


O mpyne +» Sy ego 


22 That's OK. | served with an SSBN Radioman (read: TS + nuke codes!) who was literally born 
in, and lived his first five years in, the People’s Republic of China. He even still spoke with a 


heavy Chinese accent. 
He was good people as far as | could tell, but it still seemed surreal. 
O Pro OReply Tt Shae ~ 


©) womenes + 8y ago 


Just a guy lurking on this sub but why did he still have a heavy Chinese accent if he 
only lived in China for five years? Was he just in an incredibly isolated community in 
the US? I had several friends who had that growing up as ABCs but even then they 
didn't have any accent. Any ideas why this guy did? 


O 6D Rey Ñ She ~ 


@ ora + 8y ago 


I am born in Vancouver Canada, but both of my parents are Chinese and we 
speak Chinese at home. My English is fairly good as | am at the top of my 
English class. However, my oral English still not stellar, | have a heavy Chinese 
accent. 


© O70 OD Repy Ñ Shae ~ 


©) vomnenes * 8y ago 


What do you mean by “heavy Chinese accent?” | have several Chinese 
friends who are as bilingual as they come but are still very critical of their 
languages skills despite everyone thinking they are American. Is that what 
it’s like for you? I'm genuinely curious. 

Thanks for the response! 


O 04d Q Repy Ñ Shae ~ 


O garyc801 - Sy ago + Edited 8y ago 


| think that might be me. Let me put it this way, you can understand 
me perfectly fine, | am very fluent, my tone of voice is okay too. 
However, if you are talking to me on the phone, you can tell | am 
Chinese because of my accent. Edit: | went to China when | was 6 
stayed there for about 4~5 years. | came back to Canada and finished 


high school. 
© 7D OD Reply & Share 
A noma @ ommenes - $- 
© Popular Where in China is your family from? I'd be curious if | could 


recognize if you were northern or southern Chinese. 


Q au O O55 On tse - 


@ ora » 8y ago 
MODERATION A 
North, | think. What do you mean by recognizing 
Mod Queue north/south by the way? 
3 T; Share 9 
A Mod Ma O39 Ory & 
© stubbazubba - Sy 390 
[© 1/Mod 
Pronunciation of #314 varies due to the influence of 
wi  ¢/ISSLiveFeedAr... t regional dialects. A person from Beijing and a person 
ed from Shanghai will have noticeably different accents 
k) reepa. Giy- Ér when they speak Mandarin. 


Pap O Reply Ñ She ~ 


(©) More replies 


> 


CUSTOM FEEDS 


(&) komnenos « Sy 390 
-} Create a custom feed 
Northerners have a thicker erhua accent (sometimes 


makes it sound like they are talking with marbles in 
their mouth when speaking english) and southerners 
often times have trouble saying their zh, ch, sh which 
often goes for English as well though it is becoming 
less common among young people. 

93d Q Repy Ñ Shae ~ 


(©) More replies 


(&) interrigentlacist » 5y ag0 
Like the accent of a heavy Chinese? 


© UFOmulti-reddit 


tae - 


Taiwan is a friendly like South Korea is. General assumption would be that a Taiwanese 
would be the last person to spy for PRC 


© @nd Reply & Share 


@® [deleted] - 8y ago 
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A U.S. Navy officer accused of spying for an unidentified foreign power was secretly arrested last 
summer in an espionage investigation that is ongoing, authorities said Saturday. 


The heavily redacted charge sheets say the unidentified officer gave secret information "relating to the 
national defense to representatives of a foreign government." But the four-page document does not 
say exactly what information was provided, or for how long a period it was provided, how the 


information was transmitted or which nation it was provided to. 
Latest Updates 


The multiple charges of espionage and attempted espionage, made public only on Friday, suggest the 
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The Navy's charge sheet said the officer is accused of three counts of attempted espionage, three 
counts of making false official statements and five counts of communicating defense information "to a 
person not entitled to receive said information." It also said the officer provided a false address when 
he was on leave "rather than the actual foreign destination," and failed to report contacts with foreign 
nationals. 


The Navy also accused the officer, "a married man," of procuring prostitutes "on divers occasions" and 
having sex with "a woman not his wife," a violation of the Uniform Code of Military Justice, or UCMJ. 
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The dates of the alleged espionage, the identity of the foreign spy service—if any—and the foreign 
nationals involved will not likely be disclosed until and if the Navy prefers court martial charges against 
the accused. 
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investigation, the military's version of a grand jury, to determine whether a court martial is warranted. 
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communications intelligence or cryptographic information, or any other major weapons system or 
major element of defense strategy.” 
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Navy Officer Faces 
Court Martial on 
Suspicion of Espionage 


Posted by Yancey Ellis | Jun 16, 2016 | o Comments 


The U.S. Navy has announced that they will be pursuing charges of espionage 
against Navy Lt. Cmdr. Edward Lin. He has been accused of spying for China and 
Taiwan, passing military secrets to foreign agents and an FBI informant during a 
sting operation. He has pleaded not guilty to the charges of espionage and 


mishandling “Secret” information during an arraignment in a military court 


The 39-year-old, Taiwan-born naval officer was arrested on September 11. 2015. at 


the Honolulu International Airport as he was about to travel to Asia. He served as a 
flight officer with the Special Projects Patrol Squadron Two, which is involved in 


signal and electronic communication reconnaissance using Navy spy planes. He 


was taken into custody and held for eight months at the Naval Consolidated Brig in 


Chesapeake, Virginia 


His case first became public during a preliminar rt hearing in Norfolk, Virginia 


in April During the hearing, Navy prosecutors presented video evidence of Lin's 


interrogations. According to prosecutors, Lin admitted to passing along classified 
information to a foreign representative. However. Lin's attorney. Larry Younger. has 


challenged the evidence 


According to Younger. a retired Air Force judge advocate, the evidence should not 
be admitted into evidence because the investigators did not get a clear admission 


that Lin understood right We maintain that Lt. Cmdr 


Edward ‘Eddy’ Lin is innocent of espionage. said Younger. “innocent of failing to 
follow lawful orders, innocent of false official statements and innocent of violating 


the general article, Article 134, of the Uniform Code of Military Justice 


Lt. Cmdr. Edward Lin faces ations of the iforn je of Militar 
(UCMJ). This includes violations of Articles 
material, failing to report the compromise of classified information, failing to 


ongfully transporting classified 


properly store classified material. and failing to report contact with foreign agents) 
106a (communicate secret information relating to the national defense to a 
representative of a foreign government, and attempted espionage): 107 (signed a 
false official record that failed to include foreign travel with the intent to deceive) 
and 134 (communicated information relative to national defense to a person not 


entitled to receive the information) 


Admiral Phil Davidson, commander of the U.S. Fleet Forces Command referred the 
charges to a general court martial. The Navy has set a trial date of October 26 at 
Naval Station Norfolk. Charges of adultery and prostitution were dismissed without 
prejudice. These charges could be renewed for administrative punishment at a 


later time if the Navy elects to do so 
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Younger has claimed that his client was entrapped. The investigation involved an 
FBI informant who was posing as a representative of a foreign power. Lin's attorney 
also claims that the information may not have had to be labeled as “Secret.” as 
much of the information could be found through other open sources 


Lin's family has created a website in defense of Lin's case. According to the 
website, Lin is innocent, he is not a spy. and his constitutional rights were not 
protected. His family had difficulty communicating with him and obtaining defense 
counsel for his defense. The website is seeking donations to help fund Lin's legal 


defense 
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Navy Officer to Face Court Martial for Top Stories 

Alleged Espionage From Trump's ‘attack dog’ to 
Cmdr. Edward Lin will be arraigned in Norfolk, Virginia, on Tuesday afternoon. star witness: Cohen set to 
testify in hush money trial 
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Taiwan Born Naval Officer Charged With Espionage A 
AN == stores after backlash in 2023 


> Z 
\ N A May 10 
&#151; -- Navy Lt. Cmdr. Edward Lin will face a general court martial on ee em 


charges of espionage and alleged espionage. 


Target will only sell Pride 
Month collection in some 


On Friday, the Navy announced that the admiral overseeing Lin's case had 
accepted a recommendation that there was enough evidence to warrant 
that Lin's case should proceed to a court martial on the charges. 


"On May 10, the convening authority, Admiral Phil Davidson, commander 
U.S. Fleet Forces Command, referred charges against Lt. Commande: 
Edward C.L. Lin to a general court martial,” said Lt. Commander Tim 
Hawkins, a Navy spokesman. 


Davidson elected not to refer charges relating to prostitution and adultery 
to a court martial. 


"Those charges were dismissed without prejudice,” said Hawkins, who 


added that there could be future punitive or administrative action related to 
those charges. 


Lin will be arraigned in Norfolk, Virginia, on Tuesday afternoon. 


The Taiwan-born Lin, 39, served as a flight officer in one of the Navy's most 
secretive units, Special Projects Patrol Squadron Two (VPU-2), which flies 
reconnaissance aircraft capable of intercepting signals and electronic 
communications. 


US Navy Officer Accused of Spying for China and Taiwan-> 


Taiwan Born Naval Officer Charged With Espionage 


ANALYSIS: Navy Spy Case Fraught With Intrigue and Risk to US> 


security 


Lin's case first became public at a preliminary court hearing held April 8 in 
Norfolk, where evidence was presented to a presiding officer to determine 
whether Lin's case should be recommended for a court martial. 
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Lin's interrogations made in the two days after his arrest. They said that in 
the interrogations Lin admitted to passing along secret information toa 
foreign power, though no reference was made as to which country or 
countries he was involved with. 


Prosecutors also revealed that Lin's detention resulted from alleged 
dealings he had with an FEBI informant posing as an operative for a foreign 
county, information which led Lin's defense team to say he had been 


entrapped. 


AUS. official told ABC News that preliminary indications point to possible 
espionage for either China or Taiwan, though the Naval Criminal 
Investigative Service and the FBI are continuing to investigate the case. 


Lin's attorney, Larry Youngner, made the case at the hearing that none of 
the information in Lin's interrogations should be admitted as evidence 
because NCIS investigators did not get a complete response from him if he 
understood that his rights about self-incrimination. 


Though the question was asked about his right under the Uniform Code of 
Military Justice, Youngner said Lin never provided a response because one 
of the investigators quickly switched the conversation to another topic. 

The attorney also told the presiding officer that materials Lin was alleged to 
have passed along probably did not warrant being labeled as classified 


information since they could mostly be found in open-source reporting. 


Lin's family has set up a website supporting his innocence and alleging that 
his pre-trial confinement violated his constitutional rights. 


Lin has not yet entered a plea to the charges against him. 
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Navy Spy to face Closed Court 
Hearings 


» Navy Spy to face Closed Court Hearings 


What is the status of Lt. Cmdr. Edward Lin's 
espionage case? 


As was widely reported, a Navy officer born in Taiwan has been charged with passing secrets 
to a foreign government. Lt. Cmdr. Edwin Lin is facing multiple counts of espionage, 
communicating defense information and making false statements. Lin was assigned to the 
Norfolk-based Commander Patrol and Reconnaissance Group and is currently being held in 


the Navy's brig in Chesapeake, Virginia. 


Lin already faced an Article 32 hearing and the hearing's officer will soon determine whether 
his case will proceed to a court-martial. Before his arrest last year, the lieutenant commander 
had been assigned to Special Projects Patrol Squadron 2 in Kaneohe Bay, Hawaii. The unit 
conducts highly classified missions with aircrafts outfitted with sophisticated spying 
equipment. He is suspecting with passing secrets to a country in the Asia-Pacific region, 


either his native Taiwan or China. 


Now, because of the sensitive nature of these missions, the Navy has announced it will be 


prosecuting Lin in closed court proceedings. 


“Much of the disposition of this case will be done in classified venues,” said Chief of Naval 


Operations Adm. John Richardson 


Admiral Richardson said the military is looking to avoid unwanted publicity of sensitive 
military operations. In addition, officials believe that bringing the case in an open courts- 
martial would reveal sources and methods of the military's intelligence capabilities as well as 
the secret activities it has been conducting. There is also the potential of a diplomatic crisis if 


a foreign government learned specifics of these activities. 


The question remains, however, as to whether the case will remain in the military justice 
system. Some observers argue that, given the international and domestic consequences of 
the allegations, Federal court would be the appropriate venue. While such proceedings would 
be public, the court would be closed once prosecutors introduce evidence or testimony 


containing national secrets or other classified information. 
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patronizing prostitutes. Lin moved to the U.S. when he was 14 and was finally naturalized in 
2008 after he had been serving in the Navy. While the final resolution of this matter remains 


to be seen, Lin is entitled to a defense in either a military trial or Federal court proceeding, and 


the sensitive nature of this case is best handled by a seasoned court-martial attorney. 
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Two years ago, we reported on the case of Lieutenant Commander Edward Lin, arrested 3 
as he boarded a plane in Honolulu headed for China. Lin was charged with espionage in 

what government officials said was an epic sex for secrets scandal. As we hear from 

Neal Conan in today’s Pacific News Minute, it now looks as if the allegations were 

greatly exaggerated. 


During two days of intensive interrogation following his arrest, Lieutenant Commander 
Lin appeared to dig his own grave. According to documents obtained by Navy Times, he 
confessed to passing details of some the Navy's most advanced weapons to a recently 
retired Taiwanese intelligence officer and to passing political intelligence to a female 
Taiwanese lobbyist. Initial charges also included adultery and prostitution. 


But, according to the documents uncovered by Navy Times, an investigation by the 
Naval Criminal Investigation Service concludes that the confession was false. Much of 
the case turned out to be Lin telling tales to his friends or bragging to impress women. 
In court last week, Lin pleaded guilty to failing to report foreign contacts, and to 
mishandling and disclosing classified information. Serious charges that could lead to 
30 years in prison at a sentencing hearing in June, but nothing like the sensational 
espionage allegations. Navy Times reported that Lin may in fact have been a spy earlier 
in his career for the United States. At one point, the Taiwan born Mandarin speaker 
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Neal Conan 


Over 36 years with National Public Radio, Neal Conan worked as a correspondent based in New York, 
Washington, and London; covered wars in the Middle East and Northern Ireland; Olympic Games in 
Lake Placid and Sarajevo; and a presidential impeachment. He served, at various times, as editor, 
producer, and executive producer of All Things Considered and may be best known as the long-time 
host of Talk of the Nation. Now a macadamia nut farmer on Hawai'i Island, his “Pacific News Minute" 
can be heard on HPR Tuesdays, Wednesdays, and Thursdays. 
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Military prosecutors opened their case against Commander David Alexander Morales in Norfolk, Virginia this week. It's the latest 
development in the... 
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Pacific News Minute: Retired U.S. Admiral Among High-Ranking Officers 
Indicted in Corruption Scandal 


Neal Conan, March 15, 2017 


Nine high ranking officers were arrested yesterday in the worst corruption scandal in the history of the U.S. Navy. So far, more 
than twenty former or... 
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graph 9-3, dated June 2006, as incorporated into SECNAVINST 5510.36A, dated 6 October 2006, by 
wrongfully transporting material classified as SECRET 


Specification 2 (Violation of a Lawful General Order): In that 
Navy, Commander Patrol and Reconnaissance Group, on active duty, did, at or near on or about 
fail to obey a lawful general order, to wit: SECNAV M-5510.36, paragraph 12-2, dated June 
as incorporated into SECNAVINST 5510.36A, dated 6 October 2006, by wrongfully failing to report the 
compromise of information classified as SECRET. 
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fail to obey a lawful general order, to wit: SECNAV M-5510.36, paragraph 10-3, dated June 2006, as incorporated 
into SECNAVINST 5510.36A, dated 6 October 2006, by wrongfully failing to properly store material classified as 
SECRET. 
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CHARGE I, VIOLATION OF THE UCMJ, ARTICLE 92 (CONTINUED) 


Specification 4 (Violation of a Lawful General Order): In that U.S. Navy 
Commander Patrol and Reconnaissance Group, on active duty, did, at or near on or cbou: D 


fail to obey a lawful general order, to wit: SECNAV M-5510.36, paragraph 10-3, dated June 2006, as incorporated 
into SECNAVINST 5510.36A, dated 6 October 2006, by wrongfully failing to properly store material classified as 
SECRET. 


CHARGE 11, VIOLATION OF THE UCMJ, ARTICLE 106a 


Specification | (Espionage): In that U.S. Navy, Commander Patrol and 
Reconnaissance Group, on active duty, did, at or near on divers occasions, from bot OOOO 
to about with intent or reason to believe it would be used to the advantage of a foreign nation, 
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Specification 5 (Attempted Espionage): In that 
and Reconnaissance Group, on active duty, did, at or near 


Commander Patrol 


on or about with intent or 


reason to believe it would be used to the advantage of a foreign nation, attempt to communicate SECRET information 
relating to the national defense to a representative of a foreign government 


CHARGE Ill, VIOLATION OF THE UCMJ, ARTICLE 107 
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CHARGE IV, VIOLATION OF THE UCMJ, ARTICLE 134 


Specification | (Communicating Defense Information): in that U.S. Navy, 
Commander Patrol and Reconnaissance Group, on active duty, did, at or near on ov abou: M 


x= having lawful access to information relating to the national defense of the United States, which information the said 

U.S. Navy, had reason to believe could be used to the injury of the United 
States or to the advantage of a foreign nation, knowingly and willfully communicate information relative to the national 
defense to a person not entitled to receive said information in violation of Title 18, United States Code, Section 793{d), an 
offense not capital, 


Specification 2 (Communicating Defense Information); in that U.S. Navy, 
Commander Patrol and Reconnaissance Group, on active duty, did, at or near on of EE O | 


having lawful access to information relating to the national defense of the United States, which information the said 
U.S. Navy, had reason to believe could be used to the injury of the United 
States or to the advantage of a forcign nation, knowingly and willfully communicate information relative to the national 
defense to a person not entitled to receive said information in violation of Title 18, United States Code, Section 793(d), an 
offense not capital. 


Specification 3 (Communicating Defense Information): In that US. Navy. 
Commander Patrol and Reconnaissance Group, on active duty, did, at or near on or -noot 
having lawful access to information relating to the national defense of the United States, which information the said 
U.S. Navy, had reason to believe could be used to the injury of the United 
States or to the advantage of a foreign nation, Knowingly and willfully communicate information relative to the national 
defense to a person not entitled to receive said infonnation in violation of Title 18, United States Code, Section 793(d), an 
offense not capital. 
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Commander Patrol and Reconnaissance Group, on active duty, did. at or near on or coet | 
WEB having lawful access to information relating to the national defense of the United States, which information the said 
er U.S. Navy, had reason to believe could be used to the injury of the United 


States or to the advantage of a forcign nation, knowingly ang willfully communicate information relative to the national 


defense to a person not entitled to receive said information in violation of Title 18, United States Code, Section 793(d), an 
offense not capital, 


Specification 5 (Communicating Defense Information): In that U.S. Navy, 
Commander Patrol and Reconnaissance Group, on active duty, did, at or near on or — | 
awful access to information relating to the national defense of the United States, which information the said 
U.S. Navy, had reason to believe could be used to the injury of the United 
States or to the advantage of a foreign nation, knowingly and willfully communicate information relative to the national 
defense to a person not cntitled to receive said information in violation of Title 18, United States Code, Section 793(d), an 
offense not capital. 


Specification 6 (Prostitution - Patronizing): In that U.S. Navy, Commander 
Patrol and Reconnaissance Group, on active duty, did, at or near on divers occasions from about 

to — wrongfully procure to engage in an acts of sexual intercourse for hire and 
reward with the accused, such condact being to the prejudice of good order and discipline in the armed forces and of a 
nature to bring discredit upon the armed forces, 


Specification 7 (Adultery): In that U.S. Navy, Commander Patrol and 
Reconnaissance Group, on active duty, a married man, did, at or near 
divers occasions between about wrongfully have sexual intercourse with 

a woman not his wife, such conduct being to the prejudice of good order and discipline in the armed forces and of a 
nature to bring discredit upon the anned forces 
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United States v. LCDR Edward Lin, USN 


CHARGE L VIOLATION OF THE UCMJ. ARTICLE 92 


Specification l (Violation of a Lawful General Order): In that Lieutenant Commander Edward 

C. L. Lin, U.S. Navy, Commander Patrol and Reconnaissance Group, on active duty, did, at or 

near San Francisco International Airport, San Francisco, CA on or about 12 February 2015, fail 
to obey a lawful general order, to wit: SECNAV M-5510.36, paragraph 9-3, dated June 2006, as 
incorporated into SECNAVINST 5510.36A, dated 6 October 2006, by wrongfully transporting 

material classified as SECRET. 


Specification 2 (Violation of a Lawful General Order): In that Lieutenant Commander Edward 
C. L. Lin, U.S. Navy, Commander Patrol and Reconnaissance Group, on active duty, did, at or 
near Pearl Harbor, HI, on or about 20 February 2015, fail to obey a lawful general order, to wit: 
SECNAV M-5510.36, paragraph 12-2, dated June 2006, as incorporated into SECNAVINST 

5510.36A, dated 6 October 2006, by wrongfully failing to report the compromise of information 
classified as SECRET. 

Specification 3: Dismissed with udi 

Specification 4 (Violation of a Lawful General Order): In that Lieutenant Commander Edward 
C. L. Lin, U.S. Navy, Commander Patrol and Reconnaissance Group, on active duty, did, at or 
near Pearl Harbor, HL on or about 1! September 2015, fail to obey a lawful general order, to wit: 
SECNAY M-5510.36, paragraph 10-3, dated June 2006, as incorporated into SECNAVINST 


5510.36A, dated 6 October 2006, by wrongfully failing to properly store material classified as 
SECRET. 


ADDITIONAL CHARGE, VIOLATION OF THE UCMJ. ARTICLE 92 


Specification (Violation of a Lawful General Order): In that Lieutenant Commander Edward C. 
L. Lin, U.S. Navy, Commander Patrol and Reconnaissance Group, on active duty, did, at or near 
Pearl Harbor, HI, from about February 2014 to about September 2015, fail to obey a lawful 
general order, to wit: SECNAV M-5510.30, paragraph 3-8, dated June 2006, as incorporated into 
SECNAVINST 5510.30B. dated 6 October 2006, by wrongfully failing to report foreign 
connections to his security manager. 


CHARGE IL VIOLATION OF THE UCMJ. ARTICLE 106a 


Specification 1 (Espionage): In that Lieutenant Commander Edward C. L Lin, U.S. Navy, 
Commander Patrol and Reconnaissance Group, on active duty, did, at or near Washington, D.C., 
on divers occasions, from about September 2012 to about December 2013, with intent or reason 
to believe it would be used to the advantage of a foreign nation, communicate SECRET 
information relating to the national defense to representatives of a foreign government. 
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United States v. LCDR Edward Lin, USN 


Specification 2 (Espionage): In that Lieutenant Commander Edward C. L. Lin, U.S. Navy, 
Commander Patrol and Reconnaissance Group, on active duty, did, at or near Washington, D.C., 
on divers occasions, from about April 2012 to about May 2014, with intent or reason to believe it 
would be used to the advantage of a foreign nation, communicate SECRET information relating 
to the national defense to a representative of a foreign government. 


Specification 3 (Attempted Espionage): In that Lieutenant Commander Edward C. L. Lin, U.S. 
Navy, Commander Patrol and Reconnaissance Group, on active duty, did, at or near Pearl 
Harbor, HI, on or about 1 September 2015, with intent or reason to believe it would be used to 
the advantage of a foreign nation, attempt to communicate SECRET information relating to the 
national defense to a representative of a foreign government. 


Specification 4 (Attempted Espionage): In that Lieutenant Commander Edward C. L. Lin, U.S. 
Navy, Commander Patrol and Reconnaissance Group, on active duty, did, at or near Pearl 
Harbor, HI, on or about 4 September 2015, with intent or reason to believe it would be used to 
the advantage of a foreign nation, attempt to communicate SECRET information relating to the 
national defense to a representative of a foreign government. 


Specification 5 (Attempted Espionage): In that Licutenant Commander Edward C. L. Lin, U.S. 
Navy, Commander Patrol and Reconnaissance Group, on active duty, did, at or near Pearl 
Harbor, HI, on or about 9 September 2015, with intent or reason to believe it would be used to 
the advantage of a foreign nation, attempt to communicate SECRET information relating to the 
national defense to a representative of a foreign government. 


Specification | (False Official Statement): In that Lieutenant Commander Edward C. L. Lin, 
U.S. Navy, Commander Patrol and Reconnaissance Group, on active duty, did, at nor near Pearl 
Harbor, HI, on or about 9 August 2012, with intent to deceive, electronically sign an official 
record, to wit: Standard Form 86, which record was false in that it failed to include foreign travel 
from 3 December 2011 to 10 December 2011, and was then known by the said Lieutenant 
Commander Edward C. L. Lin to be so false. 


Specification 2 (False Official Statement): In that Lieutenant Commander Edward C. L. Lin, 
U.S. Navy, Commander Patrol and Reconnaissance Group, on active duty, did, at nor near Pearl 
Harbor, HL on or about 31 October 2013, with intent to deceive, electronically sign an official 
record, to wit: an e-Leave Request dated 31 October 2013, which record was false in that it listed 
the leave address as I Ate xandria, VA rather than the actual foreign 
destination, and was then known by the said Lieutenant Commander Edward C. L. Lin to be so 
false. 
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United States v. LCDR Edward Lin, USN 


Specification 3 (False Official Statement): In that Lieutenant Commander Edward C. L. Lin, 
U.S. Navy. Commander Patrol and Reconnaissance Group, on active duty. did, at nor near Pearl 
Harbor, HI, on or about 29 April 2015, with intent to deceive, sign an official record, to wit: an 
e-Leave Request dated 1 July 2015, which record was false in that it listed the leave address as 
GR. Alexandria, VA rather than the actual foreign destination, and was then 
known by the said Lieutenant Commander Edward C. L. Lin to be so false. 


CHARGE IV, VIOLATION OF THE UCMJ, ARTICLE 134 


Specification | (Communicating Defense Information): In that Lieutenant Commander Edward 
C. L. Lin, U.S. Navy, Commander Patrol and Reconnaissance Group, on active duty, did. at or 
near Pearl Harbor, HI, on or about 21 August 2015, having lawful access to information relating 
to the national defense of the United States, which information the said Lieutenant Commander 
Edward C. L. Lin, U.S. Navy, had reason to believe could be used to the injury of the United 
States or to the advantage of a foreign nation, knowingly and willfully communicate information 
relative to the national defense to a person not entitled to receive said information in violation of 
Title 18, United States Code, Section 793(d), an offense not capital. 


Specification 2 (Communicating Defense Information): In that Lieutenant Commander Edward 
C. L. Lin, U.S. Navy, Commander Patrol and Reconnaissance Group, on active duty, did, at or 
near Pearl Harbor, HI, on or about 25 August 2015, having lawful access to information relating 
to the national defense of the United States, which information the said Lieutenant Commander 
Edward C. L. Lin, U.S. Navy, had reason to believe could be used to the injury of the United 
States or to the advantage of a foreign nation, knowingly and willfully communicate information 
relative to the national defense to a person not entitled to receive said information in violation of 
Title 18, United States Code, Section 793(d), an offense not capital. 


Specification 3 (Communicating Defense Information): In that Lieutenant Commander Edward 
C. L. Lin, U.S. Navy, Commander Patrol and Reconnaissance Group, on active duty, did, at or 
near Pearl Harbor, HI, on or about | September 2015, having lawful access to information 
relating to the national defense of the United States, which information the said Lieutenant 
Commander Edward C. L. Lin, U.S. Navy, had reason to believe could be used to the injury of 
the United States or to the advantage of a foreign nation, knowingly and willfully communicate 
information relative to the national defense to a person not entitled to receive said information in 
violation of Title 18, United States Code, Section 793(d), an offense not capital. 


Specification 4 (Communicating Defense Information): In that Lieutenant Commander Edward 
C. L. Lin, U.S. Navy, Commander Patrol and Reconnaissance Group, on active duty, did, at or 
near Pearl Harbor, HI, on or about 4 September 2015, having lawful access to information 
relating to the national defense of the United States, which information the said Lieutenant 
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United States v. LCDR Edward Lin, USN 


Commander Edward C. L. Lin, U.S. Navy, had reason to believe could be used to the injury of 
the United States or to the advantage of a foreign nation, knowingly and willfully communicate 
information relative to the national defense to a person not entitled to receive said information in 
violation of Title 18, United States Code, Section 793(d), an offense not capital. 


Specification 5 (Communicating Defense Information): In that Lieutenant Commander Edward 
C. L. Lin, U.S. Navy. Commander Patrol and Reconnaissance Group, on active duty, did, at or 
near Pearl Harbor, HI, on or about 9 September 2015, having lawful access to information 
relating to the national defense of the United States, which information the said Lieutenant 
Commander Edward C. L. Lin, U.S. Navy, had reason to believe could be used to the injury of 
the United States or to the advantage of a foreign nation, knowingly and willfully communicate 
information relative to the national defense to a person not entitled to receive said information in 
violation of Title 18, United States Code, Section 793(d), an offense not capital. 

Specification 6: Dismissed without prejudice. 

Specification 7: Dismissed without prejudice. 


Navy ‘Spy’ Edward Lin Spilled No Secrets To Taiwan 46 
The Daily Beast, Nancy A. Youssef, Shane Harris, 2016 05 06 
Washington - A U.S. Navy sailor charged with espionage didn't provide military secrets to 
a foreign government, but rather to an FBI informant who was posing as a Taiwanese 
official, military officials revealed Thursday. The latest twist in the case against Lt. Cmdr. 
Edward Lin, 39, came as military officials allowed reporters to listen to a recording from a 
military pretrial hearing heid on April 8. There, prosecutors alleged that Lin was the target of a 
sting operation that led to his arrest and two-day interrogation at the Honolulu International 
Airport last September. Prosecutors said that during questioning, Lin confessed to being a spy. 
Lin's job, working in and around military reconnaissance aircraft, gave him access to information 
about sensitive equipment that the U.S. uses to spy on its adversaries. Lin's attorney vigorously 
refuted the charges and said that his client had been denied his right to speak with a lawyer at 
the time he was arrested and questioned. The Pentagon Thursday played an 80-minute section 
from the pretrial hearing, known as an Article 32. But they left out at least a half hour that 
officiais said was classified. The recording sheds new light on Lin's case, but t aiso.raises 
several unanswered questions. And prosecutors offered no explanation of how Lin, who once 
4 ke in uniform about fulfilling his dreams of becoming a U.S. citizen, had turned from a model 
to a spy. 
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Vocabulary 


Atomic Energy Commission (AEC) — agency responsible for nuclear powe 
beginning January 1, 1947 when the Manhattan P na er cre Ato of 
Capital crime — a crime that can be punishable by death 


Clemency — forgiveness, cancellation of punishment in part or in whole 


Conspiracy — a crime in which there is an agreement among two or more p: e to engage in illegal 
activity. At the trial, the Rosenbergs and Morton Sobell were charged with conspiracy to commit espionage 


not espionage | 


Espionage — transmitting information relating to the national defense to the advantage of a foreign nation, 
pying 

Espionage Act of 1917 — first enac 

and recruitment, prohibited support to U.S 


(ex. Sedition Act of 1918, Internal S 


Facsimile — a copy or r documents (drawings and cut up Jell-O be 


ution at the Ro bergs al as demonstr s of the material allegedly us 


House Un-American Activities Committee (HUAC) — House of Represe 


ted from 1947 to 1975 was anti-communist 


Indictment — formal accusation from a grand jury w je whether there is 


a trial, required for a capital case 


Internal Security Act of 1950 (Subversive Activities Control Act or McCarran Act) — re 
Communist organizations to with the Attorr General, created board to ir 
activities, gave the government the pow ort, and revoke ship of s 


subversives 

KGB — Soviet secret police 

Manhattan Project — top-secret U.S. govern oject to build the atomic bomb 
Los Alamos — Manhattan Project lab in New 

Recognition Signal — 


Treason — a crimina 
offender owes allegiance or to betra 


treason 


Venona Project — a < 
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Overview: 


The Rosenberg 
in American history. Ethel and Julius Rose 
death for espionage on June 19 


Cold War. Considering the social and po 


ilty as charged and 
the death penalties appropriately imposed, or were they 
the victin old War fear and hysteria during the 
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Educational materials developed through the Howard County History Labs Program, a partnership between the Howard County Public School 
System and the UMBC Center for History Education. 


Resource Sheet #10 


Photograph of Julius and Ethel Rosenberg 
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Source: Higgins, Roger. “[Julius and Ethel Rosenberg, separated by heavy wire screen as they leave U.S. Court House after 
being found guilty by Jury.]” Photograph. New York: World Telegram, 1951. From Library of Congress, Washington, D.C. 
Accessed 2/2/14. http://www.loc.gov/pictures/item/97503499/ 
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Educational materials developed through the Howard County History Labs Program, a partnership between the Howard County Public School 


System and the UMBC Center for History Education. 


Resource Sheet #11 


ARCH Historical Thinking Skills Rubric — Claims, Evidence, Corroboration 


Criteria Corroboration Claim Evidence 
Constructs an Formulates a plausible Justifies claims using 
interpretation of events | interpretation, argument, appropriate direct evidence 
using information and or claim based on the from a variety of reliable 
perspectives in multiple | evaluation of evidence sources. 

4 sources. Identifies found in a variety of 
consistencies and primary and secondary 
inconsistencies among sources. 
various accounts. 
Explains similarities and | Generates a reasonable Justifies claims using some 
differences by interpretation, argument, appropriate direct evidence 
comparing information or claim based on an from a variety of reliable 
3 and perspectives in evaluation of the evidence | sources. 
multiple sources. found in selected primary 
and secondary sources. 
Identifies similarities States an interpretation, Justifies claims using 
and differences in argument, or claim that generalizations or limited 
information in multiple may or may not based on appropriate direct evidence. 
sources. evidence found in selected 
2 primary and secondary 
sources. 
Demonstrates little to Does not state an original Does not justify or support 
no attempt to examine claim, argument, or claims using appropriate 
sources for interpretation. direct evidence. 
1 corroborating or 


conflicting evidence. 


For more information on this rubric: http://www.umbc.edu/che/arch/rubric.php 
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Educational materials developed through the Howard County History Labs Program, a partnership between the Howard County Public School 
System and the UMBC Center for History Education. 


Resource Sheet #03 
Rosenberg Trial Evidence Packet 


Source A — Prosecution’s Opening Statements 


EXCERPT 1 

d We yealise that every criminal prosecution has 
grave implications, both for the defendants and for the 
people of our country. The facts, as they are 
developed before you here, will demonstrate that this 
case, where a Grand Jury has charged a conspiracy to 
commit espionage in behalf of a foreign power, is one 
of unusual significance. The significance of a 
conspiracy to commit espionage takes on added meaning 
where the defendants are charged with having partici- 
pated in this conspiracy against our country, at this, 
the most critical hours in our history, in time of war, 
around 19R. g 

ah A . 

Mind you, however, the seriousness of this 
charge does not make the 1lasue complicated, The indict- 
ment returned by the Gmd Jury is a simple one. The 
Grand Jury, as you know, is a body of citizens, like you, 
chosen by lot, as you were, and sworn to investigate and 
uncover crime., Such a Grand Jury has charged that the 
three defendants before you, Julius Rosenberg, his wife, 
Ethel Rosenberg, and Morton Sobell, conspired with others 
to commit espionage. The Grand Jury charge is contained 
in a one-count indictment, which his Honor has read to you. 
It is charged that the three defendants, the Rosenbergs 
and Sobell, from 1944, until the time when they were 
indicted by this Grand Jury some months ago, conspired 
and agreed with each other and also with other conspirators, 


ineluding Harry Gold, David Greenglass, David's wife, Ruth 
REDE oe ft 
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Educational materials developed through the Howard County History Labs Program, a partnership between the Howard County Public School 
System and the UMBC Center for History Education. 


hls 8 = 
Greenglass, and one, Anatoli Yakovlev, an agent and 
official of the Soviet Union, and with others. The 
Grand Jury has charged that the object and the purpose 
of this conspiracy by these people was their plan to 
deliver information, documents, sketches and material 
vital to the national defense of our country, to a 
foreign power, namely, to Soviet Russia. 

It is charged by the Grand Jury that these 
conspirators did that with the intent that the informa 
tion, the documents, the sketches and material, which 
have described to you, should be used by the Soviet 
Union to its advantage. That is the charge which is 


now before you for your final judgment. 
EXCERPT 2 


The evidence will show that the loyalty and 
the allegiance of the Rosenbergs and Sobell were not to 
our country, but that it was to Communism, Communism 


in this country and Communism throughout the world, 


Source: United States of America vs. Julius Rosenberg, Ethel Rosenberg, Anatoli A. Yakovlev, also known as 
“John”, David Greenglass and Morton Sobell. United States District Court, Southern District of New York, March 
6, 1951. Rosenberg Trial Transcript, p. 220. Famous Trials website by Douglas O. Linder. University of 
Missouri-Kansas City School of Law. Accessed 2/13/14. 
<http://law2.umkc.edu/faculty/projects/ftrials/rosenb/ROS TRIA.HTM> 
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Educational materials developed through the Howard County History Labs Program, a partnership between the Howard County Public School 
System and the UMBC Center for History Education. 


Resource Sheet #03 


Rosenberg Trial Evidence Packet 
Source B — Defense’s Opening Statements 


EXCERPT 1 
What I would like te impress upon you now is 


to remember at all times the oath that you took when 
you were sworn in as jurors, which followed the sequence 
of questions addressed to you by the Court to test your 
impartiality that you will render an honest and a true 
verdict according to the evidence and according to the 
law as laid down by the Court. We ask you, we plead 
with you, don't be influenced by any bias orprejudice 
or hysteria. 

This is a very grave crime that these defendants 
are charged with. Very grave. And this trial arises in 
a rather tense international atmosphere. And I think 
all of us delude ourselves that we believe that we are 
completely free from all of those pressures and influences 


that every minute of the day are upon us. 


EXCERPT 2 


These defendants are charged with a conspiracy 


to commit espionage. The Government has to show not 
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that they believed in one ism or another ism, but that 
they conspired to commit espionage. 

Finally, I would like you, of course, to pay 
particular attention to the witnesses that appear here 
and judge th issues by what comes out of the witnesses' 
mouths. And in that connection pay very careful atten- 
tion to the witness. Test yourself by the same stand- 
ards which guides your conduct in your everyday affairs; 
is this the kind of person who is telling the truth? 
What motive has this person to say thus and so. And I 
want you to focus your attention particularly on three 
witnesses who we now hear will appear for the Government. 
One is David Greengrass, who is a defendant here and who 
has pleaded guilty. In other words, he is a self-confessed 
conspirator. And the testimony of his wife, Mrs. Ruth 
Greengrass, who is an alleged co-conspirator but not a 


defendant, and who, and I am talking about the Greengrasses 


Source: United States of America vs. Julius Rosenberg, Ethel Rosenberg, Anatoli A. Yakovlev, also known as 
“John”, David Greenglass and Morton Sobell. United States District Court, Southern District of New York, March 
6, 1951. Rosenberg Trial Transcript, p. 238. Famous Trials website by Douglas O. Linder. University of 
Missouri-Kansas City School of Law. Accessed 2/13/14. 
<http://law2.umkc.edu/faculty/projects/ftrials/rosenb/ROS TRIA.HTM> 
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Educational materials developed through the Howard County History Labs Program, a partnership between the Howard County Public School 
System and the UMBC Center for History Education. 


Resource Sheet #03 


Rosenberg Trial Evidence Packet 
Source D — Sketches Re-created by David Greenglass 


mO | Seer rn Sketch 1 (Left) 


EXHIB 
U; Lee a ; 
A <a = AL. ut Title: Cross-section Sketch of Atomic Bomb, 


03/12/1951 


1447 


MAR 12 1951 


EXHIBIT JAN 
U. S. Dist. Court ` 
A D, of N.Y. 


Æ 
E 
| 


| 
5 
(a 
= 


ERIGA EKCLLOSIN E LENS mod 


Sketch 2 


Title: Lens Mold Sketch from the 
Atomic Bomb Drawn by David 
Greenglass, 01/1945 


Sketch 3 (Left) 


Title: Sketch of Setup to Implode Tubular 
Materials, 03/12/1951 


Source: U.S. vs. Julius & Ethel Rosenberg and Martin Sobell. Photographs and other Graphic Materials from the Department of 
Justice, Office of the U.S. Attorney for the Southern Judicial District of New York (1870- ). Record Group 118: Records of U.S. 
Attorneys, 1821-19914. The U.S. National Archives and Records Administration at New York, New York, NY. Accessed 2/13/14. 
Sketch 1: .http://research.archives.gov/description/278753 

Sketch 2: http://research.archives.gov/description/278747 

Sketch 3: http://research.archives.gov/description/278752 
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Educational materials developed through the Howard County History Labs Program, a partnership between the Howard County Public School 
System and the UMBC Center for History Education. 


Resource Sheet #03 


Rosenberg Trial Evidence Packet 
Source E — Trial Testimony of David Greenglass 


EXCERPT 1 


Q: Now will you tell us just what happened, Mr. Greenglass, after you handed this sketch and 
the descriptive material concerning the atomic bomb to Rosenberg? What did he do, what did 
the others there do? 


A: Well, he stepped into another room and he read it and he came out and he said, “This is 
very good. We ought to have this typed up immediately.” And my wife said, “We will probably 
have to correct the grammar involved,” because | was more interested in writing down the 
technical phrases of it than | was in correcting the grammar. So they pulled—they [the 
Rosenbergs] had a bridge table and they brought it into the living room, plus a typewriter. 


Q: What kind of typewriter? 
A: A portable. 
Q: Then what? 


A: And then they set that up and each sentence was read over and typed down in correct 
grammatical fashion. 


Q: Who did the typing, Mr. Greenglass? 


A: Ethel did the typing and Ruth and Julius and Ethel did the correction of the grammar. 


EXCERPT 2 

Q: Well, the question is, did you lose money? 
A: | did lose money. 

Q: How much? 


A: | lost all of the money | originally put into G. & R. [business partnership with Julius and 
David’s brother], plus subsequent loss of money in salaries that | did not get. 


: And how much did that total, in your mind? 

: Well, | don’t know. 

: Approximately? 

: A few thousand dollars. 

: Now, is it not a fact that you never recovered a single penny of that money? 


: | never recovered a single penny of it. 


Source: United States of America vs. Julius Rosenberg, Ethel Rosenberg, Anatoli A. Yakovlev, also known as “John”, David Greenglass 
and Morton Sobell. United States District Court, Southern District of New York, March 6, 1951. Rosenberg Trial Transcript, p. 722 & 
967. Famous Trials website by Douglas O. Linder. University of Missouri-Kansas City School of Law. Accessed 2/13/14. 
http://law2.umkc.edu/faculty/projects/ftrials/rosenb/ROS TRIA.HTM 
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Educational materials developed through the Howard County History Labs Program, a partnership between the Howard County Public School 
System and the UMBC Center for History Education. 


Resource Sheet #03 

Rosenberg Trial Evidence Packet 

Source F — Testimony of Ruth Greenglass to the Grand Jury, August 1950 
-på 11 Ruth Greengless 

Q Well, now, you returned to New Yor} in the early 
part of December, 1944; is that correct? A Yea, + Gid, 

¢ and when you returned cic Julius fosenberg come over 
to see you at your home st 266 Stanton Street, New itork City 
A A fow days later he came. 

G Did he come alone? 4 Yes, 

© ana he had a conversation with you? A Yes. 

Q Sow, was there anyone present besides you and Julius 
Rosenberg when you hac this conversation? A No. 

O dow, can you relate es test you can, te the best of 
your recollection, the conversation that took place between 
you and Julius Rosenberg on this occasion? A Well, Julius 
esked me if 1 had related the information to my hunband, ond 
I told him I had, and that he hed consented to do this. and 


then 1 tela him of beat as I coulc remember what David told 
me ebout the physicel setup and the nemes of the scientists 
I heve elready given. 

Q And whet did Rosenberg say? + fell, he was pleased) 
at receiving the trformation, 

& Dión't you write thet down on a piece of paper? 
A Yes, I wrote that down on & piece of paper and he took 
it with him, 

C In longheand? A Yen. 

Q And did you write it down in his presence? 


A 1 believe so. 


« Anc Gid yo ssy he said he waa pleasec? A Yes. 


Source: Transcript, US v Julius Rosenberg, et. al., August 3, T National Security Archives, George Washington University, 


Washington, D.C. Accessed 2/6/14. nbergcasefiles-greenglass-ruth- 
pg9132to9161.pdf 
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Educational materials developed through the Howard County History Labs Program, a partnership between the Howard County Public School 
System and the UMBC Center for History Education. 


Resource Sheet #03 


Rosenberg Trial Evidence Packet 


Source G — Excerpt of Trial Testimony of Ruth Greenglass, March 1951 


“RUTH GREENGLASS: Well, Ethel said that she was tired, and | asked her what she had been 
doing. She said she had been typing; and | asked her if she had found David's notes hard to 
distinguish. She said no, she was used to his handwriting. Then she said that Julie, too, was 
tired; that he was very busy; he ran around a good deal; that all his time and his energies were 
used in this thing; that was the most important thing to him..” 


Source: Testimony of Ruth Greenglass, March 1951. From “Famous Trials Page,” University of Missouri-Kansas City School of 
Law. Accessed 2/6/14. <http://law2.umkc.edu/faculty/projects/ftrials/rosenb/ROS TRGR.HTM> 


Source H — Excerpt of Prosecution’s Closing Speech 


“This description of the atom bomb, destined for delivery to the Soviet Union, was typed up by 
the defendant Ethel Rosenberg that afternoon at her apartment at 10 Monroe Street. Just so 
had she on countless other occasions sat at that typewriter and struck the keys, blow by blow, 
against her own country in the interests of the Soviets.” 


Source: Closing Speech of Prosecutor Irving Saypol,, Rosenberg Case. From “Famous Trials Page,” University of Missouri- 


Kansas City School of Law. Accessed 2/6/14. <http://law.umkc.edu/faculty/projects/ftrials/rosenb/ROS_TSAY.HTM> 
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Did Edward Lin leak 


i MH310 alien abduction videos? 
Of 
7 have JOU been misintormed x A a UNITED STATES v. LIN (2019) 

TALAS Ye by reality debunkers? ve >in 
€ anit Lets take a look at his appeals casel menairas 


On 11 September 2015, as the appellant was about to board a flight from Honolulu to the Peoples Republic o 


Court: U.S. Navy-Marine Corps Court of 


UNITED STATES, Appellee v. Edward C. LIN, Lieutenant Commander (0-4), U.S. Navy, Criminal Appeals. 


< 


China, agents from the Naval Criminal Investigative Service (NCIS) and the Federal Bureau of Investigation Upon being taken into custody, the appellant was questioned, amongst other things, about his planned 


(FBI) arrested the appellant. At the time of his arrest, the appellant had been the subject of a fifteen-month- 
long counterintelligence investigation#P rior to attempting to board his China-bound flight, law enforcement 


officers discovered that the appellant had concealed his true destination#from his command by completing a 
false leave request formendicating that he would be traveling to Alexandria, Virginia, his home of record. 


e believed to be a foreign agentfend with whom he 


communicated and Shared classified informationswas actually an undercover United States law enforcement 
counterintelligence agent fas part of the investigation, the undercover agent recorded approximately 10 hours 


of conversations with the = a substantial E in Mandarin Chinese. 


The appellant also admittedghat, despite not disclosing them to his command security officer, he had @igse 
relationships ith several foreign persons, ceea several pegis iere SEN some he pelcyedig 


be foreign agents fHe corresponded T COonversed with these foreign agents about Maier Siaies poney and 


DOsitonesre was particularly open in his communications with two women with whom he conversed. With 


these women, be shared classified informationico cc’ >) (airs Ototes soon onanG J 


capabilities of the United States military. 


activities in China. Over the course of two days of questioning, which was recorded by law enforcement, he 


explained that he planned to meet a local national femaleswhom he had met on an online dating sitno 


whom he knew to be a Chinese government employee. 


: idence investigation also revealed that this was hot the first timaathe appellant Concealed 
Unbeknownst to the appellant, one of the women 1€ counterintelligence investigation also revealed t s was hot the first e appellant|concealed J 


foreign travemrom his command. In October 2013, after requesting and receiving leave to travel to Alexandria, 


Virginia, the appellant instead traveled to Taiwan. Prior to traveling to Taiwan, the appellant had arranged to 


meet@vith a senior Taiwanese military officer™nd several other Taiwanese officers of lesser rank. 


Like the military judge below, we too have considered the appellant's extensive case in extenuation and 


mitigation. However, weighing against the appellants otherwise commendable service and conduct is the 


seriousness of his misconduct which includ eoa 


believed to be foreign agents, falsifying his leave requests, and mishandling classified documents. 


The appellant's mishandling of classified information, however, was hot limited fo his discussions with these 


women. He also mishandled classified documents—®While returning on a commercial flight from a deployment 


The appellant was convicted, Bonsistent with his pleas, of three specifications of violating a lawful general in February 2015, the appellant (ee. Department of Homeland 


order, two specifications of making false official statements @nd two specifications of Ji security officer found the classified documents while conducting an inspection of the appellant's checked 


communicating information relative to the national defense of the United States to a person not entitled to 
eee Violation of Articles 92, 107, and 134, Uniform Code of Military Justice (UCMJ), 10 U.S.C. §§ 892, 
907, and 934.2 


TLS MAN IS Nor A HERO. LE BERATED ETS CANNA 
AND HTS FAM HE MONETI4SD TLE TRUST OUR 


MILITARY PUT IN Gl 0N THE PURSUIT OF SATTISIFYINe 
UNCECKED IMPULSE, DO TOUR RESENR1 
TRNK FOR YOURSELR 00:00:53:08 
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luggage and confronted the appellant about the documents. | he appel! an (in 
proper security of the classified documents, asked the officer to dispose of the documents) 
documents with the officer. The appellant admitted that he did not know whether the officer had the required 


clearance to view or possess the classified documents. | he appe!l!ant 


compromise of classified documents. Additionally, aire) Cr C 2|SO NGI 
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Dispelling Myths!How 
Classificationsand 


Declassification Actually Work 


(Editor's Note: The authors share their insights on U.S. government classification and 
declassification process on the Just Security Podcast. Listen to the episode here). 


‘The discovery of classified documents in the personal residences and offices of Donald 
Trump, Mike Pence, and Joe Biden have reinvigorated a public conversation surrounding the 
U.S. government's classification system that seems to emerge every few years. In 2015, it was 
former Secretary of State Hillary Rodham Clinton’s use of a private email server. In 2010 and 
2013, it was disclosures by Chelsea Manning and Edward Snowden, respectively. Yet, despite 
the long history of classified document scandals, many journalists, judges, lawyers, and other 
outside observers hold fundamental misconceptions about how classification and 
declassification actually work in the federal government on a day-to-day basis. Since the 
Mar-a-Lago scandal broke, numerous well-intentioned articles have attempted (see here, 
here, and here) to explain classification and declassification to the public, along with prolific 
pontificating from “experts” on Twitter, but this commentary often overlooks basic realities 
about how the U.S. classification system operates. Drawing from the authors’ experiences at 
the Central Intelligence Agency and Department of Defense, this article seeks to dispel 
several myths that have emerged about classification and declassification, particularly 
regarding presidential and yice-presidential authority, while also providing perspective on 
how these processes are carried out in the real world. 


Classification 101 


Ar its core, classified information is information relating to national security that warrants 
special protection from unauthorized disclosure, due to the damage to national security that 
may result from its release. Ostensibly, this information assists presidents in carrying out 
their constitutional duties as commander-in-chief and other responsibilities relating to 
national security and foreign affairs. But in reality, only a small fraction of this information 
actually reaches the president; the vast majority is used by rank-and-file government 
employees who perform a broad range of national security functions to support these 
presidential powers. It is also important to understand that the executive branch’s consistent 
position across administrations is that classified information is created, owned, and 
controlled by the president, and that Congress and the courts have extremely limited power 
to intrude on the president's authority over this information. 


‘The classification regime is governed by an executive order issued by the president, the 
current version of which is Executive Order 13526. The order sets forth who can classify and 
declassify information, which categories of information can be classified, marking and 
handling instructions for classified records, and several other rules and restrictions. 
Information is classified as Top Secret, Secret, or Confidential depending on the level of harm 
to national security that “reasonably could be expected to result” from its unauthorized 
disclosure. This phrase is key, yet most explainers overlook it. It means that it does not have 
to be certain that the release of such information would harm national security, just that it 
“reasonably could be expected.” The difference between “will” and “could” is an important 
distinction that is often overlooked. 


Another underappreciated fact is that information is classified, not documents. Documents 
are marked as classified depending on the information they contain. The classification 
marking on the document reflects the highest level of classification for the information 
contained in the document. But technically speaking, the document isn’t classified; it’s the 
information in the document that is classified. This distinction is important to 
understanding how derivative classification and declassification work, as explained further 
below. 


Reality #1: The Role and Importance of “Original Classification Authorities” is Vastly 
Overstated 

There are two types of government officials in the world of classified information: original 
classification authorities, commonly referred to as “OCAs,” and derivative classifiers. Every 
document, image, map, notebook, or email with a classification marking must receive that 
marking from either an OCA or a derivative classifier. Most explainers and commentators 
focus on the importance of OCAs in the classification system and treat the OCA title with a 
sort of reverence while typically overlooking the role of derivative classifiers. 


An OCA is an official who has been granted special authority under Executive Order 13526 
“to classify information in the first instance,” meaning they may determine what level of 
classification is appropriate (Top Secret, Secret, or Confidential), the duration of 
classification, and whether the other core re 
met. The president and vice president are OCAs, as are agency heads designated by the 
president and other officials who have been delegated this authority in writing. As of 2021, 
there were 1,491 OGAs within the federal government. For comparison, approximately 


ements of Executive Order 13526 have been 


million Americans hold and use a security clearance. OCAs are required to receive annual 
training, and whenever the government files a declaration in court explaining why 
information is properly classified, it always comes from an OCA. That said, the vast majority 
of OCAs have regular duties that are wholly unrelated to classification, but automatically 
receive the OCA authority by virtue of their position. 


While being an OCA sounds like an important responsibility, the reality is that the vast 
majority of OCAs never exercise that authority. As a practical matter, almost all records 
within the federal government are not classified by OCAs; instead, they are derivatively 
classified by rank-and-file government employees. Derivative classification is set forth in 

ion 2of the Executive Order 13526 and is typically overlooked. Derivative classification 
can occur in two ways. First, if a government employee is creating a new document and pulls 
in classified source material from another document, that official is required to “carry 
forward” the classification markings for the sourced information, Second, information can be 
derivatively classified in accordance with classification guides, when an employee consults a 
published guide to determine the appropriate classification level (more on that below). 


Statistics bear this our. In 2017, approximately 99.88 percent of all classification decisions 
were derivative, rather than being original classification decisions made by an OCA. This 
means that in the government's daily classified workflow, OCAs might as well not exist - 
except to the limited extent necessary to create the classification guides. As one example, 
over a five year period, only one CIA employee - the head of the agency’s classification 
program — exercised their OCA authority. Presidents and vice presidents also rarely exercise 
their OCA authority. Most documents they handle are derivatively classified before ever 
reaching thelr desks. They might originally classify their notes and other documents they 
create in the first instance, but rarely go beyond that. 


Because of how derivat 


ve classification authority works, most employees will never consult 
with an OCA regarding classification decisions. Instead, they look to one of 2,116 
classification guides that exist within the federal government. Classification guides are 
prepared by a very small subset of OCAs — either the senior official in charge of classification 
for the agency or the OCA responsible for the information at issue, Some agencies, like the 
CIA, have one classification guide covering the entire agency. In contrast, the Department of 
Defense, which has multiple agencies and departments within its sprawling organization, 
has over 1,500 guides! 


The classification guide of the Office of the Director of National Intelligence (ODNI) 
illustrates how the guides operate. Sections 3.1-3.8 of the guide set forth categories of 
information and the level at which they should be classified. If an ODNI employee drafts a 
report using ODNT information, they consult the guide to decide how to classify the 
document. For instance, if the document contained information about an intelligence 
collection capability, the author would consult the “Collection” section of the guide (section 
3.3) and determine at what level the information should be classified, which generally 
depends on how specific the information is and to what degree it could expose the collection 
method. In this scenario, the derivative classifier is not actually classifying the information 
in the document; the OCA who wrote the guide has already classified that broad category of 
information, and the employee is simply deciding which categories apply to the information 
at issue and then marking the document appropriately. If the author also relied on 
information from another document, such as a CIA cable, they should “carry forward” the 
Classification level for the cable's information into the new document. In theory, the author 
should “portion mark” each paragraph in the document with the appropriate classification 
level for that paragraph, although in reality, this often doesn’t happen except in formal 
documents. Finally, the author should then give the document an overall classification level 
(indicated in its header and footer) that reflects the highest classification level of the 
information it contains. To enforce all of this, IT systems for national security agencies 
typically require employees to classify a document, with reference to the applicable guide 
section, prior to saving it (or prior to sending an email). 


At least this is how it’s supposed to work. The reality is that many government employees 
don’t give much thought to the proper classification level for the documents they create. 
‘They are too busy, they are not classification experts, and the guides are dense and far from 
user-friendly. A typical employee might have a general feel for when a document should be 
classified Confidential versus Secret versus Top Secret, but they will not typically spend 
much time analyzing that question and will spend even less time reading the guide itself. As 
mentioned, IT systems typically require the author to cite the applicable classification guide 
section when saving documents or sending an email, but the systems also let employees 
create “favorites” that allow them to quickly select the classification level (with reference to 
a specific guide section, like “Collection-Top Secret”) with a single click. 


IF OCAs hold a power that is almost irrelevant to our classification system, why do 
commentators give them so much attention? One reason is that when classified information 
is litigated in court ~ such as in Freedom of Information Act (FOIA) proceedings, state 
secrets assertions, or criminal prosecutions — the government invariably files declaration 
from an OCA explaining why the information is currently and properly classified. In doing so, 
however, the OCA is not exercising their OCA authority to classify the information at issue. 
Almost always, the information has already been derivatively classified by a lower-level 
employee who created the relevant documents, The OCA is instead supporting a 
classification decision that was already made, (although in some instances, they might revise 
it slightly). Viewed this way, the OCA essentially serves as an expert witness who is testifying 
as to why the information is currently and properly classified. In theory, any employee with 
requisite experience could file these declarations, but courts and the Department of Justice 
have grown to accept that this testimony should come from an OCA. The “OCA” title is 
simply an expert qualification, like having an advanced degree. 
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Reality #2: Declassification Authority Is More Important than Original Classification 
‘Authority 

All that said, there is a closely-related authority that matters quite a bit in these OCA 
declarations, and that is declassification authority, Declassification authority is the power to 
take information that was previously classified and render it unclassified and therefore 
releasable to the public. Section 3.1(b) of Executive Order 13526 explains that an OCA can 
declassify information only if they originally classified it or are the successor to the person 
who originally classified it. As explained above, OCAs rarely classify information originally, 
so this type of declassification authority is somewhat toothless. However, OCAs or other 
officials can separately receive “delegated declassification authority in writing by the agency 
head or the senior [classification] official at the agency.” This delegated authority gives the 
recipients broader authority to declassify information originating from their agency. It might 
apply to all information originating from the agency, or only to information originating from 
a specific department of the agency. Given the weightier responsibilities, only a fraction of 
OCAs also have this delegated declassification authority. 


‘Most officials who sign declarations in court have declassification authority in addition to 
being an OCA. This declassification authority is critical, and it is the authority that they 
actually exercise when filing their declarations. In hyper-technical terms, they are actually 
declining to exercise their declassification authority. Because the information at issue was 
normally classified before coming before the court, there is nothing to classify originally. 
Instead, the declarant is really explaining why the information remains properly classified 
and therefore cannot be publicly released pursuant to the declarant’s declassification 
authority, This nuance Is lost even on many government attorneys, however, so the 
declarations typically just read more like an explanation of why the information was properly 
Classified in the first instance. 


Reality #3: There are Three Distinct Types of Declassification 


Although the term “declassification” has now entered the public discourse, thanks in part to 
former President Donald Trump's unsupported claims that he declassified the White House 
records he took to his Mar-a-Lago home, most commentators overlook the fact that there are 
actually three distinct types of declassification. Executive Order 13526 defines 
declassification as “the authorized change in the status of information from classified 
information to unclassified information.” That’s easy enough to understand, but from there 
things get more complicated. While with each type of declassification, information is taken 
from classified to unclassified, how, and why one gets to that point differs in meaningful 
ways. 


‘The first type of declassification is the most common but doesn’t have a name, so let's just 
call it “routine” declassification. Routine declassification occurs when the information “no 
longer meets the standards for classification under” Executive Order 12526, It simply means 
that someone, likely a derivative classifier, considered the information classified at one point 
in time, but naw the declassification authority reviewing the information has determined 
that it no longer meets the executive order's classification requirements. This most 
commonly occurs because the official determines that public disclosure of the information 
could no longer be expected to harm national security, either (1) due the passage of time or 
changed circumstances or (2) because the derivative classifier misclassified the information 
in the first instance. Routine declassification may be carried out by the OCA who classified 
the information originally, their successor, their supervisor, or officials who have specifically 
been granted delegated declassification authority (referenced above). The Director of 
National Intelligence and other senior, designated ODNI officials may also declassify sources 
and methods information. Routine declassification most regularly occurs when reviewing 
records for release under a FOIA request and other public release programs, and agencies 
typically grant declassification authority to officials who supervise these releases, 


The second type of declassification is “public interest” declassification, which can occur 
when the “public interest in disclosure outweighs the damage to the national security.” It 
differs from routine declassification in two important ways: First, with routine 
declassification, an official has determined that the release of the information would not 
harm national security, but with public interest declassification, the official believes it would 
still harm national security, but that the public interest outweighs the need to protect the 
information. Second, public interest declassification may only be exercised by the agency 
head or the senior classification official at the agency, which is a much more limited universe 
of people than routine classification. Not surprisingly, then, public interest declassification is 
exercised more sparingly. Some examples include declassifying information for use in 
espionage, leaks, or terrorism prosecutions, or the declassification of information about 
Russia's war plans in the lead up to its invasion of Ukraine. 


Prudent government lawyers typically recommend that any public interest declassification 
decisions be documented in a memorandum from the agency head, so there is a clear record 
of what was declassified. The memorandum also provides evidence that the declassification 
was a deliberate, carefully considered decision. Whenever “X” information is declassified, 
outsiders (FOIA requestors, criminal defendants, and others) will often then claim that “Y” 
and “2” information should be declassified too. If the government has a public interest 
declassification memo to point to, it can make it easier to explain that this was a one-time, 
discretionary decision based on a careful public interest balancing, and that the 
declassification did not extend further by careful design. But this documentation is not a 
requirement and as discussed below, this type of formality often does not take place when 
the president declassifies the information. 


‘The third type of declassification is “automatic” declassification, which occurs solely based 
on the passage of time, when the duration of classification surpasses the limits set forth in 
Executive Order 13526. Under section 3.3 of the Order, automatic declassification 
requirements typically begin 25 years after the information was classified, but there are 
exemptions that can extend protection for particularly sensitive information. The rules on 
automatic declassification are complicated, but itis important to understand that automatic 
declassification is similar to public interest declassification in that the release of the 
information might actually harm national security, but the president has determined 
(through the rules set forth in Executive Order 13526) that it should still be released due to 
the passage of time and the public's interest in accessing this historical information. 


‘The term “declassification” is thrown around quite frequently, but it is important to always 
stop and consider which type of declassification is being discussed. Even many goverment 
officials do not understand these distinctions, and it’s doubtful that someone like Trump 
considered which type of declassification he was employing when he attempted to declassify 
various Russia-related documents. In addition, readers now know not to be fooled into 
thinking that a significant public release is Imminent whenever a president calls for a 
“declassification review” of certain records. That can simply refer to a “routine” 
declassification review, which means that any information that is currently classified will 
remain that way at the conclusion of the review. If you want a forward-leaning review, look 
for indicators of a “public interest” declassification review. 


Reality #4: Presidents Have Broad Declassification Authority and Need Not Follow Any 
Formal Procedures 

‘Trump's unsupported claims that he declassified the White House records at Mar-a-Lago also 
generated conversation about the president's power to declassily information. Here, too, 
much of the commentary was misinformed, Everyone rightly agrees that the president has 
broad declassification authority, Focusing just on its language, Executive Order 13526 grants 
declassification authority to “a supervisory official of either the originator or his or her 
successor in function, if the supervisory official has original classification authority.” As head 
of the executive branch, the president would plainly qualify as a “supervisory official” over 
all other OCAs. Even putting that language aside, given that classified information is created 
by and for the president under the Order, the president also has inherent authority to 
declassify information (1) as the creator of Executive Order 13526 and (2) through their 
constitutional authority over national security information. See, e.g, Dept. of the Navy v. 
Fgan, 4841.8. 518, 527 (1988) (“[Presidential] authority to classify and control access to 
information bearing on national security...{lows primarily from this constitutional 
investment of [Commander in Chief] power in the President."). 


The only question then is: must the president follow any specific declassification 
procedures? The answer is a resounding no for two reasons. First, Executive Order 13526 on 
its face contains no such declassification procedures. The Order sets forth (1) who may 
declassify information and (2) what standards they should apply, but beyond thar, there is no 
additional process required. While both individual agencies and the Information and 
Security Oversight Office have developed additional rules about how declassification should 
be carried out, none of these procedures apply to the president. Second, given the president's 
constitutional authority over both classified information and the administration of 
presidential executive orders, even if Executive Order 13526 did establish constraints, they 
are at most self-constraints that the president has the power to ignore. 


‘Yet, again, commentators regularly got this point wrong, instead claiming that there are 
formal declassification procedures that apply to the president. They often cite New York 
Times v. Central Intelligence Agency, in which the Second Circuit stated that “declassification, 
even by the President, must follow established procedures,” citing Executive Order 13526. 
This is a great example of how even courts and, in some instances, the Department of Justice 
itself (which asserted the same proposition in its appellate brief), do not fully understand 
declassification. Executive Order 13526 is a public document and relatively short. Ifit 
outlines declassification procedures that apply to the president, it should not be hard to find 
them. But neither the commentators nor the Second Circuit cite to any specific provisions in 
the Order, and for good reason — they do not exist. 


Ideally, the President should normally follow certain procedures when declassifying 
information. The obvious correctness of this proposition is likely what led to the Second 
Circuit's mistake, along with the fact that it was bending over backwards to avoid finding 
that Trump declassified a covert program with a single tweet. It sounds like the right answer, 
but it’s not legally supported. In a perfect world, anytime the president wanted to declassify 
something, they would (1) consult with senior officials from the agencies that originated the 
information, as well as those with an interest in the information (for instance, the State 
Department if the information had diplomatic repercussions) and (2) document the decision 
in writing so that agencies could properly implement it, including by downgrading and 
properly marking documents that contained the declassified information, But even then, the 
president should be free to declassify information by whatever means they choose. For 
instance, on the night of the Osama bin Laden raid, President Obama was fully within his 
power to promptly declassily the existence of the operation via his nationally televised 
speech. One could imagine other scenarios where the president determines that its a 
national security imperative to quickly declassify information to share it with the public. It 
‘would be unwise to impose formal processes and documentation requirements in these types 
of situations, even if the best practices outlined above should still be followed where 
possible. 


If Congress is interested in legislating in this area, the best solution is to require that 
anytime the president orders the declassification of certain information, the congressional 
oversight committees be promptly notified in writing of what was declassified and why. A. 
similar requirement already exists with covert action notification under 50 U.S.C. § 
3093without unduly inhibiting the president, even though ordering covert action is an 
important presidential authority. While this provision would not require the president to 
follow any procedures before declassifying information, the necessity of informing Congress 
in writing after the fact would have the practical effect of imposing some discipline on the 
process. 
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Reality #5: Presidents Rarely Declassify Information 


Another important point missing from the commentary about presidential declassification 
authority is that presidents rarely exercise these powers. This 
including the fact that White House and National Security Council (“NSC”) staff typically 
don’t want to burden the president with personally declassifying information. This is 
especially true when the underlying events being declassified generate bad publicity. Instead, 
what normally happens is that the White House and NSC staff, after consulting with the 
president, direct the relevant agencies to carry out a declassification process, while at most 
providing general guidance as to what they want to be disclosed and how forward-leaning 


true for several reasons, 


the agencies should be during their reviews. This is not ordering declassification, but rather 
Initiating a declassification process. 


One example of this more informal process is when the president wants to give a speech on a 
topic of national importance, such as when Obama spoke about U.S. government drone 
strikes. A draft of the speech is written, marked and treated as classified, and remains 


classified while going through the interagency review process. Once the relevant parties are 


comfortable with the speech, the classification markings are removed and it is considered 
declassified. In some instances, a classification expert from the relevant agency might review 
it shortly before release to formally “bless” its declassified status, but this person would 
typically just defer to what that the interagency process produced. The point, however, is 
that there is typically no specific presidential declassification order associated with this 


process. 


The same thing might happen if there is a pending document release, which could come 
through a FOIA case, the publication of a congressional report, or the discretionary release of 
historical documents. Here too there might be general direction from the White House and 
NSC staff to the agencies processing these releases, but the president will rarely get involved 
in the details, and formal written orders are rarely issued. Even when the famous “Bin Ladin 


Determined To Strike in US” Presidential Daily Brief was declassified and released in April 
2004, it was Director of Central Intelligence George Tenet who declassified it, not President 


George W. Bush. More recently, President Biden got credit for ordering the declassification of 
certain documents about the September 11th attacks, including information about Saudi 
A the order closely it becomes clear that he ordered the 


abia’s role, but when readin; 
agencies to evaluate the records for decla: 
anything, although he did encourage the agencies to lean forward and engage in public 


interest declassification. 


sification; Biden did not personally declassify 


Outside of a deliberate process, a president personally effectuating the declassification of 
information normally happens just by saying something publicly, or even Tweeting it. Again, 
on the night of the bin Laden raid, Obama decided in the span of a few hours to declassify 
the existence of the operation — no special formalities or written orders were required. In the 
strange era of Twitter under Trump, he declassified information on numerous occasions by 
simply hitting the “send” button, including the time he published a reportedly classified 
image of an Iranian missile site. Although it may have been unwise, this action was perfectly 
lawful, even if no formal process was involved. 


Presidents perhaps mast commonly make ad hoc information release decisions when 
engaging with foreign leaders on national security matters. There are formal inter-agency 
processes in place for clearing classified information for release to foreign governments, 
which the National Security Council typically follows when preparing presidents for 
discussions with foreign leaders. Presidents are not bound by this process, however, and can 
make on the spot decisions that result in sharing additional, uncleared classified information 
with those leaders. Whether this sharing results in declassification of that information is a 
complicated, fact-dependent question on what was was shared, with whom, and under what 
circumstances, but it’s still another example of where the president is not bound by the 


formal rules that apply to the rest of the Executive Branch. 


‘The point of all this is that instances where the president personally orders the 


declassification of information are relatively rare. In Mat 


2013, Obama declassified the fact 


that four Americans were killed in U.S. counterterrorism operations outside of areas of active 


hostilities, which was then disclosed in a letter to Congress from Attorney General Eric 


Holder, In April 2015, Obama declassified another U.S. counterterrorism operation that 
accidentally killed two hostages, one of whom was a U.S. citizen, Warren Weinstein. 
Ironically, one of the best example of a formal declassification order from a president over 
the last two decades comes from Trump, who issued a memo declassifying materials from the 
FBI's Crossfire Hurricane investigation the day before he left office - Jan. 19, 2021. This order 
may end up undercutting Trump’s claims that he was declassifying documents in his head at 
the same time, given the formalities that he followed by issuing the memo. 


Reality #6: Vice-Presidential Declassification Authority is Very Limited 


Finally, due to the discovery of classified records at Biden's home and personal residence 
from his time as vice president, and similar revelations involving Mike Pence, there has also 
been discussion about vice presidential declassification authority. The vice president does 
have declassification authority, but it is quite limited. Under Executive Order 13526, the vice 
president has original classification authority, which means they may also declassify 
information that they or their predecessor originally classified. However, as a practical 
matter, the vice president — like the president - originally classifies litle, if any, information, 
rendering this declassification authority mostly moot. The only argument that the vice 
president has declassification authority beyond this would rest on distinct declassification 


authority provided for certain “supervisory officials.” But as a general matter, the vice 
sidered a supervisory official of other executive branch officials, so this 
broader declassification authority does not apply to the vice president. 


president is not con 


Conclusion 


‘The point of this article is 
analysis. The U.S. classification regime is confusing, even for those who regularly operate 
within it. But it is important for outside observers to understand how dassification and 


lot to pick on the commentators who missed the mark with their 


declassification actually work on a day-to-day basis, especially since those issues are now a 
regular part of the public discourse. With respect to presidential authorities, it is equally 
important for the public to understand that the classification system ultimately rests on the 
assumption that the president will act in good faith, not out of spite, and in the national 
interest, not personal predilection. Most presidents have done so to date, which is why we 
have not previously had dialogue about presidential declassification authority and what 
limits should be placed on it. Trump's departure from those norms has shown the weakness 
of that assumption, and time will tell whether such conduct is a temporary anomaly or a new 
norm 
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SUBJECT: DoD Information Security Program: Protection of Classified Information 


References: See Enclosure 1 


1. PURPOSE 


a. Manual. This Manual is composed of several volumes, each containing its own purpose. 
The purpose of the overall Manual, as authorized by DoD Directive (DoDD) 5143.01 (Reference 
(a)) and DoD Instruction (DoDI) 5200.01 (Reference (b)), is to reissue DoD 5200.1-R 
(Reference (c)) as a DoD Manual to implement policy, assign responsibilities, and provide 
procedures for the designation, marking, protection, and dissemination of controlled unclassified 
information (CUT) and classified information, including information categorized as collateral, 
sensitive compartmented information (SCI), and Special Access Program (SAP). This guidance 
is developed in accordance with Reference (b), Executive Order (E.O.) 13526, E.O. 13556, and 
part 2001 of title 32, Code of Federal Regulations (CFR) (References (d), (e), and (f)). This 
combined guidance is known as the DoD Information Security Program. 


b. Volume. This Volume: 


(1) Provides guidance for safeguarding, storage, destruction, transmission, and 
transportation of classified information. 


(2) Identifies security education and training requirements and processes for handling of 
security violations and compromise of classified information. 


(3) Addresses information technology (IT) issues of which the security manager must be 
aware. 


(4) Incorporates and cancels Assistant Secretary of Defense for Command, Control, 
Communications, and Intelligence Memorandums (References (g) and (h)). 


2. APPLICABILITY. This Volume: 
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a. Applies to OSD, the Military Departments, the Office of the Chairman of the Joint Chiefs 
of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the 
Department of Defense, the Defense Agencies, the DoD Field Activities, and all other 
organizational entities within the Department of Defense (hereinafter referred to collectively as 
the “DoD Components”). 


b. Does not alter existing authorities and responsibilities of the Director of National 
Intelligence (DNI) or of the heads of elements of the Intelligence Community pursuant to 
policies issued by the DNI. Consistent with Reference (b), SCI shall be safeguarded in 


accordance with the policies and procedures issued by the DNI, as implemented by DoD 
5105.21-M-1 (Reference (i)) and other applicable guidance. 


3. DEFINITIONS. See Glossary. 


4. POLICY. It is DoD policy, in accordance with Reference (b), to: 


a. Identify and protect national security information and CUI in accordance with national- 
level policy issuances. 


b. Promote information sharing, facilitate judicious use of resources, and simplify 
management through implementation of uniform and standardized processes. 


c. Employ, maintain and enforce standards for safeguarding, storing, destroying, 
transmitting, and transporting classified information. 


d. Actively promote and implement security education and training throughout the 
Department of Defense. 


e. Mitigate the adverse effects of unauthorized access to classified information by 
investigating and acting upon reports of security violations and compromises of classified 
information. 


5. RESPONSIBILITIES. See Enclosure 2 of Volume 1. 


6. PROCEDURES. See Enclosures 2 through 7. 


7. INFORMATION COLLECTION REQUIREMENTS. All inspections, investigations, 
notifications, and audits referred to in this issuance do not require licensing with a Report 
Control Symbol in accordance with Paragraphs 1, 2, 4, and 7 of Volume 1 of DoD Manual 
8910.01 (Reference (j)). 
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8. RELEASABILITY. Cleared for public release. This Volume is available on the Directives 
Division Website at https://www.esd.whs.mil/DD/. 


9. SUMMARY OF CHANGE 3. The change to this issuance updates references and 
organizational titles and removes expiration language in accordance with current Chief 
Management Officer of the Department of Defense direction. 


10. EFFECTIVE DATE. This Volume is effective February 24, 2012. 
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ENCLOSURE 1 


REFERENCES 


DoD Directive 5143.01, “Under Secretary of Defense for Intelligence and Security 
(USDU&S)),” October 24, 2014, as amended 

DoD Instruction 5200.01, “DoD Information Security Program and Protection of Sensitive 
Compartmented Information (SCJ),” April 21, 2016, as amended 

DoD 5200.1-R, “Information Security Program,” January 14, 1997 (cancelled by Volume 1 
of this Manual) 

Executive Order 13526, “Classified National Security Information,” December 29, 2009 
Executive Order 13556, “Controlled Unclassified Information,” November 4, 2010 

Part 2001 of title 32, Code of Federal Regulations 

Assistant Secretary of Defense for Command, Control, Communications, and Intelligence 
Memorandum, “Revised Alternative Compensatory Control Measures (ACCM) Guidance,” 
April 18, 2003 (hereby cancelled) 

Assistant Secretary of Defense for Command, Control, Communications, and Intelligence 
Memorandum, “Classified Information at Meetings and Conferences,” October 26, 2001 
(hereby cancelled) 

DoD Manual 5105.21, Volume 1, “Sensitive Compartmented Information (SCI) 
Administrative Security Manual: Administration Of Information And Information Systems 
Security,” October 19, 2012, as amended 

DoD Manual 8910.01, Volume 1, “DoD Information Collections Manual: Procedures For 
DoD Internal Information Collections,” June 30, 2014, as amended 

DoD Instruction 5230.09, “Clearance of DoD Information for Public Release,” January 25, 
2019 

DoD Manual 5200.02, “Procedures For The DoD Personnel Security Program (PSP),” 
April 3, 2017 

DoD Instruction 5400.04, “Provision of Information to Congress,” March 17, 2009 
Department of Defense/Government Printing Office Security Agreement, 1981! 

DoD Instruction 7650.01, “Government Accountability Office (GAO) and Comptroller 
General Requests for Access to Records,” January 27, 2009, as amended 

DoD Directive 5405.2, “Release of Official Information in Litigation and Testimony by 
DoD Personnel as Witnesses,” July 23, 1985 

DoD Directive 5230.20, “Visits and Assignments of Foreign Nationals,” June 22, 2005 
Committee on National Security Systems Instruction 4004, “Destruction and Emergency 
Protection Procedures for COMSEC and Classified Material,” August 20067 

DoD Instruction 8510.01, “Risk Management Framework (RMF) for DoD Information 
Technology (IT),” March 12, 2014, as amended 

Chapters 22 and 33 of title 44, United States Code 

DoD Instruction 5015.02, “DoD Records Management Program,” February 24, 2015, as 
amended 


1 Contact Security Directorate, Office of the Deputy Under Secretary of Defense for Intelligence 
? Documents issued by the Committee on National Security Systems (CNSS) are available at www.cnss.gov/full- 
index.html 
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(v) DoD Instruction 8500.01, “Cybersecurity,” March 14, 2014, as amended 

(w) DoD 5220.22-M, “National Industrial Security Program Operating Manual,” February 28, 
2006, as amended 

(x) Parts 120 through 130 of title 22, Code of Federal Regulations (also known as “The 
International Traffic in Arms Regulations”) 

(y) DoD Directive 5230.11, “Disclosure of Classified Military Information to Foreign 
Governments and International Organizations,” June 16, 1992 

(z) DoD Instruction O-2000.16, “DoD Antiterrorism (AT) Program Implementation,” 
November 17, 2016, as amended 

(aa) DoD Instruction 5240.05, “Technical Surveillance Countermeasures (TSCM),” April 3, 
2014, as amended 

(ab) United States Security Authority for NATO Affairs Instruction 1-07, “Implementation of 
NATO Security Requirements,” April 5, 20073 

(ac) Department of Defense and United Kingdom Ministry of Defense, “Security Implementing 
Arrangement,” January 27, 20034 

(ad) Chairman of the Joint Chiefs of Staff Manual 3150.29C, “Code Word, Nickname, and 
Exercise Terms Report (NICKA) System,” December 7, 2007° 

(ae) DoD Directive 5000.01, “The Defense Acquisition System,” May 12, 2003, as amended 

(af) Chairman of the Joint Chiefs of Staff Manual 5720.01B, “Joint Staff Message Management 
and Preparation,” February 15, 2005° 

(ag) DoD Directive 5205.07, “Special Access Program (SAP) Policy,” July 1, 2010, as amended 

(ah) DoD Directive 5210.56, “Arming and The Use of Force,” November 18, 2016 

(ai) DoD Instruction 3224.03, “Physical Security Enterprise and Analysis Program (PSEAP),” 
June 4, 2020 

(aj) Federal Specification FF-L-2740, “Locks, Combination,” current edition’ 

(ak) Federal Standard 832, “Construction Methods and Materials for Vaults,” September 1, 
2002’ 

(al) Federal Specification FF-L-2937, “Combination Lock, Mechanical,” January 31, 2005, as 
amended’ 

(am) Federal Specification AA-F-358, “Filing Cabinet, Legal and Letter Size, Uninsulated, 
Security,” current edition® 

(an) Federal Specification AA-V-2737, “Modular Vault Systems,” April 25, 1990, with 
Amendment 2, October 30, 2006’ 

(ao) Federal Specification FF-P-110, “Padlock, Changeable Combination (Resistant To Opening 
By Manipulation and Surreptitious Attack),” current edition, as amended’ 

(ap) Section 1386 of title 18, United States Code 


3 Available to authorized recipients from the Central U.S. Registry 

4 Contact the Director, International Security Programs, Defense Technology Security Administration, Office of the 
Under Secretary of Defense for Policy 

5 Restricted distribution. Contact J-3, Office of the Joint Chiefs of Staff 

5 This document is For Official Use Only. It is available to authorized recipients at 
https://ca.dtic.mil/cjcs_directives/index.htm 

7 Available through DoD Lock Program at https://locks.navfac.navy.mil at the Documents, Federal Specifications 
tab for Federal Specifications or Documents, Directives and Guidance tab for Federal Standards and Military 
Handbooks. 

8 Available through GSA at http://www.gsa.gov/portal/content/103856#Federal Specifications 
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(aq) Federal Standard 809, “Neutralization and Repair of GSA Approved Containers and Vault 
Doors,” current edition’ 

(ar) National Security Agency/Central Security Service Evaluated Product List 02-01, 
“NSA/CSS Evaluated Products List for High Security Crosscut Paper Shredders” (also 
Annex A to NSA/CSS Specification 02-01, “High Security Crosscut Paper Shredders”), 
current edition 

(as) National Security Agency/Central Security Service Evaluated Product List 02-02, 
“NSA/CSS Evaluated Products List for High Security Disintegrators” (also Annex A to 
NSA/CSS Specification 02-02, “High Security Disintegrators”), current edition 

(at) Military Handbook 1013/1A, “Design Guidelines for Physical Security of Facilities,” 
December 15, 1993” 

(au) Underwriters Laboratories Inc., Standard 634, “Standard for Connectors and Switches for 
Use with Burglar-Alarm Systems,” October 12, 2007° 

(av) National Security Agency/Central Security Service Policy Manual 3-16, “Control of 
Communications Security (COMSEC) Material,” August 2005?° 

(aw) Executive Order 13549, “Classified National Security Information Program for State, 
Local, Tribal, and Private Sector Entities,” August 18, 2010 

(ax) Committee on National Security Systems, National Security Telecommunications and 
Information Systems Security Instruction (NSTISSI) No. 7003, “Protective Distribution 
Systems (PDS),” December 13, 1996 

(ay) DoD Instruction 5200.33, “Defense Courier Operations (DCO),” June 30, 2011, as 
amended 

(az) DoD Manual 5220.22, Volume 2, “National Industrial Security Program: Industrial 
Security Procedures for Government Activities,” August 1, 2018 

(ba)Chapter I of title 39, Code of Federal Regulations 

(bb) DoD Instruction 8523.01, Communications Security (COMSEC), April 22, 2008 

(bc) Intelligence Community Directive 503, “Intelligence Community Information Technology 
Systems Security Risk Management, Certification and Accreditation,” September 15, 
2008"! 

(bd) Department of Defense Foreign Clearance Manual, September 5, 2011" 

(be) DoD Directive 5105.65, “Defense Security Cooperation Agency (DSCA),” October 26, 
2012 

(bf)DoD Directive 8140.01, “Cyberspace Workforce Management,” August 11, 2015, as 
amended 

(bg) Dod Instruction 3305.13, “DoD Security Education, Training, and Certification,” February 
13, 2014, as amended 

(bh) DoD Instruction 5205.11, “Management, Administration, and Oversight of DoD Special 
Access Programs (SAPs),” February 6, 2013, as amended 

(bi) Section 2723 of title 10, United States Code 

(bj) Intelligence Community Directive 701, “Security Policy Directive for Unauthorized 
Disclosures of Classified Information,” March 14, 2007'° 


? Available from Underwriters laboratories Inc. at http://www.ul.com/global/eng/pages/solutions/standards 
10 Available to authorized recipients at 
www.iad.nsa.smil.mil/resources/library/nsa_office_of_policy_section/index.cfm 

11 Available at http://www.dni.gov/electronic_reading_room/ICD_503.pdf 

12 Available at https://www.fcg.pentagon.mil 
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(bk) Sections 102, 105, 5524 and 552a” of title 5, United States Code 

(bl) DoD Instruction 5230.24, “Distribution Statements on Technical Documents,” August 23, 
2012, as amended 

(bm) DoD Directive 5240.06, “Counterintelligence Awareness and Reporting (CIAR),” May 17, 
2011, as amended 

(bn) Committee on National Security Systems, National Security Telecommunications and 
Information Systems Security Instruction (NSTISSI) No. 4003, “Reporting and Evaluating 
COMSEC Incidents,” December 2, 1991 !° 

(bo) Section 3161 of Public Law 105-261, “National Defense Authorization Act for Fiscal Year 
1999,” as amended 

(bp) DoD Directive 5240.02, “Counterintelligence,” March 17, 2015, as amended 

(bq) DoD Directive 8000.01, “Management of The Department of Defense Information 
Enterprise (DoD IE),” March 17, 2016, as amended 

(br) Committee on National Security Systems Policy 18, “National Policy on Classified 
Information Spillage,” June 200616 

(bs) Committee on National Security Systems Instruction 1001, “National Instruction on 
Classified Information Spillage,” February 2008'° 

(bt) Assistant Secretary of Defense for Command, Control, Communications and Intelligence 
Memorandum, “Disposition of Unclassified DoD Computer Hard Drives,” June 4, 2001 

(bu) Assistant Secretary of Defense for Networks and Information Integration Memorandum, 
“Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and 
Removable Storage Media,” July 3, 2007 

(bv) Assistant Secretary of Defense for Networks and Information Integration Memorandum, 
“Department of Defense (DoD) Guidance on Protecting Personally Identifiable Information 
(PII),” August 18, 2006 

(bw) Director, Administration and Management Memorandum, “Safeguarding Against and 
Responding to the Breach of Personally Identifying Information,” September 25, 2008 

(bx) DoD Instruction 8170.01, “Online Information Management and Electronic Messaging,” 
January 2, 2019 

(by) DoD Instruction 8320.02, “Sharing Data, Information, and Technology (IT) Services in the 
Department of Defense,” August 5, 2013, as amended 

(bz) DoD Instruction 5210.02, “Access to and Dissemination of Restricted Data and Formerly 
Restricted Data,” June 3, 2011, as amended 

(ca) Deputy Secretary of Defense Memorandum, “Protection of NATO Classified Information 
Stored, Processed or Transmitted in U.S. Communication and Information (CIS) Systems 
and Networks,” September 8, 2000 

(cb) Deputy Secretary of Defense Memorandum, “Web Site Administration,” 
December 7, 1998 

(cc) Dod Instruction 5200.39, “Critical Program Information (CPI) Identification and Protection 
Within Research, Development, Test, and Evaluation (RDT&E),” May 28, 2015, as 
amended 


13 Available on JWICS at http://www. intelink.ic.gov/sites/ppr/policyHome/default.aspx 

14 Also known and referred to in this volume as “The Freedom of Information Act (FOIA),” as amended 
15 Also known and referred to in this volume as “The Privacy Act of 1974, as amended” 

16 NTISSI and documents issued by the Committee on National Security Systems (CNSS) are available at 
www.cnss.gov/full-index.html 
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(cd) DoDD 5400.07, “DoD Freedom of Information Act (FOIA) Program,” April 5, 2019 

(ce) Section 403 of title 50, United States Code (also known as “The National Security Act of 
1947,” as amended ) 

(cf) Executive Order 12333, “United States Intelligence Activities,” December 4, 1981, as 
amended 

(cg) Section 2162 of title 42, United States Code (also known as “The Atomic Energy Act of 
1954,” as amended ) 
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ENCLOSURE 2 


SAFEGUARDING 


1. CONTROL MEASURES. DoD Components shall have a system of control measures that 
ensure access to classified information is limited to authorized persons. The control measures 
shall be appropriate to the environment in which access occurs and to the nature and volume of 
the information. The system shall include technical, physical, and personnel control measures. 
Administrative control measures, which may include records of internal distribution, access, 
generation, inventory, reproduction, and disposition, shall be required when technical, physical, 
and personnel control measures are insufficient to deter and detect access by unauthorized 
persons. Except as otherwise specified, requests for waivers to the provisions of this Volume 
shall be submitted in accordance with section 16 of Enclosure 3 of Volume 1. 


2. PERSONAL RESPONSIBILITY FOR SAFEGUARDING, Everyone who works with 
classified information is personally responsible for taking proper precautions to ensure that 
unauthorized persons do not gain access to classified information. Everyone granted access to 
classified information is personally responsible for protecting the classified information they 
know, possess, or control and for complying with the pre-publication security review processes 
specified in DoDI 5230.09 (Reference (k)). Classified information shall be protected at all times 
either by storing it as this Volume prescribes or by having it under the personal observation and 
control of an authorized individual. 


3. ACCESS TO CLASSIFIED INFORMATION. Except as provided in sections 5 and 6 of this 
enclosure and in accordance with section 11 of Enclosure 3 of Volume 1, no person may have 
access to classified information unless that person has a security clearance in accordance with 
DoD Manual 5200.02 (Reference (1)) and has signed a Standard Form (SF) 312, “Classified 
Information Non-Disclosure Agreement” (NDA), and access is essential to the accomplishment 
of a lawful and authorized Government function (i.e., has a need to know). 


4. DETERMINING NEED FOR ACCESS. The individual with authorized possession, 
knowledge, or control of the information has the final responsibility for determining whether a 
prospective recipient’s official duties requires them to possess or have access to any element or 
item of classified information, and whether that prospective recipient has been granted the 
appropriate security clearance by proper authority. 


5. EMERGENCY AUTHORITY. In emergencies in which there is an imminent threat to life or 
in defense of the homeland, the Heads of the DoD Components may authorize the disclosure of 
classified information, including information normally requiring the originator’s prior 
authorization, to an individual or individuals who are otherwise not routinely eligible for access. 
The disclosing authority shall: 
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a. Limit the amount of classified information disclosed to the absolute minimum to achieve 
the purpose. 


b. Limit the number of individuals who receive classified information. 


c. Transmit the classified information through approved Federal government channels by the 
most secure and expeditious method consistent with this Volume, or by other means deemed 
necessary when time is of the essence. 


d. Provide instructions about what specific information is classified and how it should be 
safeguarded. Information disclosed shall not be deemed declassified as of result of such 
disclosure or subsequent use by a recipient. Physical custody of classified information must 
remain with an authorized Federal government entity in all but the most extraordinary 
circumstances. 


e. Provide appropriate briefings to the recipients on their responsibilities not to disclose the 
information to unauthorized individuals and obtain a signed SF 312. 


f. Notify the agency or DoD Component originating of the information and the Deputy 
Under Secretary of Defense for Intelligence, and Security (DUSD(I&S)) within 72 hours of the 
disclosure of classified information, or at the earliest opportunity that the emergency permits but 
no later than 30 days after the release, by providing: 

(1) A description of the disclosed information. 

(2) Identification of individuals to whom the information was disclosed. 

(3) How the information was disclosed and transmitted. 

(4) Reason for the emergency release. 

(5) How the information is being safeguarded. 

(6) A description of the briefings provided. 

(7) A copy of the signed SF(s) 312. 
6. ACCESS BY INDIVIDUALS OUTSIDE THE EXECUTIVE BRANCH. Classified 
information may be made available to individuals or agencies outside the Executive Branch, as 
provided in this section, if such information is necessary for performance of a lawful and 
authorized function, and such release is not prohibited by the originating department or agency. 
The Heads of DoD Components shall designate officials to ensure the recipient’s eligibility for 


access, prior to the release of classified information. (See Volume 1, Enclosure 3, section 11 for 
requirements for access by individuals inside the Executive Branch.) 
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a. Congress. DoDI 5400.04 (Reference (m)) provides rules for access to classified 
information or material by Congress, its committees, members, and staff representatives. 
Members of Congress, by virtue of their elected position, are not investigated or cleared by the 
Department of Defense. 


b. Government Printing Office (GPO). Collateral documents and material of all 
classifications may be processed by the GPO, which protects the information according to a 
DoD/GPO Security Agreement (Reference (n)). 


c. Representatives of the Government Accountability Office (GAO). DoDI 7650.01 


(Reference (0)) sets forth rules for granting GAO representatives access to classified information 
that the Department of Defense originates and possesses when such information is relevant to the 
performance of the statutory responsibilities of that organization. Certifications of security 
clearances and the basis therefore, shall be accomplished under arrangements between the GAO 
and the relevant DoD Component. Personal recognition or presentation of official GAO 
credential cards are acceptable for identification purposes, but not for access to classified 
information. 


d. Historical Researchers. Persons outside the Executive Branch who are engaged in 
historical research projects may be authorized access to classified information provided that the 
DoD Component Head or senior agency official with classification jurisdiction over the 
information: 


(1) Determines, in writing, that such access is clearly consistent with the interests of 
national security in view of the intended use of the material to which access is granted by 
certifying that the requester has been found to be eligible for access pursuant to Reference (1) and 
section 3 of this enclosure. 


(2) Limits access to specific categories of information over which the DoD Component 
has classification jurisdiction or for which the researcher has the written consent of the DoD 
Component or non-DoD agency with classification jurisdiction. The information contained 
within or revealed by the specified categories must be within the scope of the research. 


(3) Maintains custody of the classified material at a DoD installation or activity or 
authorizes access to documents held by the National Archives and Records Administration 
(NARA). 


(4) Obtains the requester’s agreement to safeguard the information and to submit any 
notes and manuscripts intended for public release for review by all DoD Components or non- 
DoD departments or agencies with classification jurisdiction to determine whether classified 
information is contained therein. The agreement shall be documented by execution of a 
statement substantially similar to that in Figure 1. 
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Figure 1. Conditions Governing Access to Official Records by Historical Researchers 


To Whom It May Concern: 


I understand that the classified information to which I have requested access for historical research purposes is 
concerned with the national defense or foreign relations of the United States. Unauthorized disclosure could 
reasonably be expected to cause damage, serious damage, or exceptionally grave damage to the national security 
depending on whether the information is classified Confidential, Secret, or Top Secret, respectively. If granted 
access, I therefore agree to the following conditions governing access to the [insert Component or activity] files: 


1. I will abide by any rules and restrictions issued in your letter of authorization, including those of other Agencies 
whose information is interfiled with that of the [insert Component or activity]. 


2. I agree to safeguard the classified information to which I gain possession or knowledge in a manner consistent 
with Part 4 of Executive Order 13526, “Classified National Security Information,” and the applicable provisions of 
the DoD regulations concerning safeguarding classified information, including Volumes 1, 2, and 3 of DoD Manual 
5200.01, “DoD Information Security Program.” 


3. I agree not to reveal to any person or Agency any classified information obtained because of this access except as 
authorized in the terms of your authorization letter or a follow-on letter. I further agree that I shall not use the 
information for purposes other than those set forth in my request for access. 


4. I agree to submit my research notes for review to determine if classified information is contained in them before 
their removal from the specific area assigned to me for research. I further agree to submit my manuscript(s) for a 
security review before its publication or presentation. In each of these reviews, I agree to comply with any decision 
of the reviewing official in the interests of the security of the United States, including the retention or deletion of any 
classified parts of such notes and manuscript whenever the Federal Agency concerned deems such retention or 
deletion necessary. 


5. I understand that failure to abide by the conditions in this statement shall constitute sufficient cause for canceling 
my access to classified information and for denying me any future access and may subject me to criminal provisions 


of Federal Law as referred to in Item 6. 


6. I have been informed that provisions of title 18 of the United States Code impose criminal penalties, under 
certain circumstances, for the unauthorized disclosure, loss, copying, or destruction of defense information. 


THIS STATEMENT IS MADE TO THE UNITED STATES GOVERNMENT TO ENABLE IT TO EXERCISE 
ITS RESPONSIBILITY FOR THE PROTECTION OF INFORMATION AFFECTING THE NATIONAL 


SECURITY. I UNDERSTAND THAT ANY MATERIAL FALSE STATEMENT THAT I MAKE KNOWINGLY 
AND WILLFULLY SHALL SUBJECT ME TO THE PENALTIES OF TITLE 18, U.S. CODE, SECTION 1001. 


Signature: 


Witness's Signature: 


Date: 
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(5) Authorizes access, in writing, for no more than 2 years from the date of issuance. 
The DoD Component may renew access for 2-year periods in accordance with DoD Component- 
issued regulations. 


e. Presidential or Vice Presidential Appointees and Designees. Persons who previously 
occupied senior policy-making positions to which they were appointed or designated by the 


President or Vice President may not remove classified information upon departure from office, 

as all such material shall remain under the U.S. Government’s security control. Such persons 
may be authorized access to classified information they originated, reviewed, signed, received, or 
that was addressed to them while serving as an appointee or designee, provided that the DoD 
Component Head or senior agency official with classification jurisdiction for such information: 


(1) Determines, in writing, that such access is clearly consistent with the interests of 
national security in view of the intended use of the material to which access is granted and by 
certifying that the requester has been found to be eligible for access pursuant to section 3 of this 
enclosure. 


(2) Limits access to items that the person originated, reviewed, signed, or received while 
serving as a Presidential or Vice Presidential appointee or designee. 


(3) Retains custody of the classified material at a DoD installation or activity or 
authorizes access to documents in the custody of the NARA. 


(4) Obtains the requestor’s agreement (SF 312) to safeguard the information and to 
submit any notes and manuscript for pre-publication review by all DoD Components and non- 
DoD departments or agencies with classification jurisdiction to determine that no classified 
information is contained therein. 


f. Use of Classified Information in Litigation. DoDD 5405.2 (Reference (p)) governs the use 
of classified information in litigation. 


g. Special Cases. When necessary in the interests of national security, the Heads of the DoD 
Components or their senior agency official may authorize access to classified information by 
persons outside the Federal government, other than those enumerated in section 5 of this 
enclosure and paragraphs 6.a through 6.f of this section. Prior to authorizing access, such 
official must determine that the recipient is reliable, loyal, and trustworthy for the purpose of 
accomplishing a national security objective; meets the requirements of section 3 of this 
enclosure; and can and will safeguard the information from unauthorized disclosure. The 
national security objective shall be stated in the authorization, which shall be in writing. This 
authority may not be further delegated. 


7. VISITS. The Heads of the DoD Components shall establish procedures to accommodate 
visits to their Component facilities involving access to, or disclosure of, classified information. 
As a minimum, these procedures shall include verifying the identity, personnel security 
clearance, access (if appropriate), and need to know for all visitors. 


Change 3, 07/28/2020 18 ENCLOSURE 2 


88 


89 


DoDM 5200.01-V3, February 24, 2012 


a. Visit requests shall be processed and security clearance and access level verified using the 
Joint Personnel Adjudication System (JPAS) for DoD civilian, military, and contractor personnel 
whose access level and affiliation are reflected in JPAS. Fax, telephone, or other appropriate 
method shall be used for those personnel whose access level and affiliation are not reflected in 
JPAS. 


b. Visits by foreign nationals to DoD Components and facilities, except for activities or 
events that are open to the public, shall be handled in accordance with DoDD 5230.20 
(Reference (q)) and documented in the Foreign Visits System Confirmation Module. 


8. PROTECTION WHEN REMOVED FROM STORAGE. An authorized person shall keep 
classified material removed from storage under constant surveillance. Classified document cover 
sheets (SF 703, “Top Secret (Cover sheet);” SF 704, “Secret (Cover sheet);” or SF 705 
“Confidential (Cover sheet)”) shall be placed on classified documents not in secure storage. The 
cover sheets show, by color and other immediately recognizable format or legend, the applicable 
classification level. 


9. END OF DAY SECURITY CHECKS. The heads of activities that process or store classified 
information shall establish a system of security checks at the close of each duty and/or business 
day to ensure that any area where classified information is used or stored is secure. SF 701, 
“Activity Security Checklist,” shall be used to record such checks. An integral part of the 
security check system shall be the securing of all vaults, secure rooms, and containers used for 
storing classified material. SF 702, “Security Container Check Sheet,” shall be used to record 
such actions. SFs 701 and 702 shall be retained and disposed of as required by Component 
records management schedules. 


10. EMERGENCY PLANS. Plans shall be developed to protect, remove, or destroy classified 
material in case of fire, natural disaster, civil disturbance, terrorist activities, or enemy action, to 
minimize the risk of compromise, and for the recovery of classified information, if necessary, 
following such events. The level of detail and the amount of testing and rehearsal of these plans 
shall be determined by assessing the risk of hostile action, foreign intelligence threats, natural 
disaster, or terrorist activity that may place the information in jeopardy. 


a. Use the requirements of Committee on National Security Systems (CNSS) Instruction 
4004 (Reference (r)) when developing plans for the emergency protection (including emergency 
destruction under no-notice conditions) of classified communications security (COMSEC) 
material. 


b. When preparing emergency plans, consider: 


(1) Reducing the amount of classified material on hand. 
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(2) Storing less frequently used classified material at other secure locations. 


(3) Creating regular back up copies of information in electronic formats for off-site 
storage. 


(4) Transferring as much retained classified information to removable electronic media 
as possible, thereby reducing its bulk. 


11. USE OF SECURE COMMUNICATIONS. In accordance with the requirements of 
Enclosure 4, classified information shall be transmitted only over secure communications circuits 
approved for transmission of information at the specified level of classification. This includes 
communication by telephone, facsimile, e-mail and other forms of electronic communications 
(e.g., messages, websites). See Volume 2 of this Manual for guidance on required markings. 


12. REMOVAL OF CLASSIFIED INFORMATION FOR WORK AT HOME. When it is 
mission critical for individuals to remove classified information and materials (e.g., IT 
equipment and associated storage media) for work at home, specific security measures and 
approvals are required. Security measures appropriate for the level of classification must be in 
place to provide adequate protection and security-in-depth and to prevent access by unauthorized 
persons. Compliance with section 13 of Enclosure 4 of this Volume is also required. 


a. Top Secret. Only the Secretary of Defense, the Secretaries of the Military Departments, 
the Chairman of the Joint Chiefs of Staff, the Combatant Commanders, or the senior agency 
officials appointed pursuant to section 5.4(d) of Reference (d) may authorize the removal of Top 
Secret information from designated working areas for work at home. Such officials may also 
authorize removal of information for work at home for any lower level of classification. 


b. Secret and Confidential. The Heads of the DoD Components may authorize removal of 
Secret and Confidential information from designated working areas for work at home. This 
authority shall not be delegated below the major command or equivalent level. 


c. Residential Storage Equipment. A General Services Administration (GSA)-approved 
security container shall be furnished for residential storage of classified information. Written 
procedures shall be developed to provide for appropriate protection of the information, including 
a record of the classified information that has been authorized for removal for work at home. 


d. Classified IT Systems. See section 7 of Enclosure 7 of this Volume when classified IT 
equipment will be used. All residential classified network connections must be certified and 
accredited in accordance with DoDI 8510.01 (Reference (s)) requirements. 


e. Foreign Country Restriction. Work at home may be authorized in foreign countries only 


when the residence is in a specific location where the United States enjoys extraterritorial status 
(e.g., on the embassy, chancery, or consulate compound) or on a U.S. military installation. 


Change 3, 07/28/2020 20 ENCLOSURE 2 


90 


91 


DoDM 5200.01-V3, February 24, 2012 


13. WORKING PAPERS. Working papers are documents (e.g., notes, drafts, prototypes) or 
materials (e.g., printer ribbons, photographic plates), regardless of the media, created during 
development and preparation of a finished product. Working papers and materials are not 
intended or expected to be disseminated. Working papers and materials containing classified 
information shall be: 


a. Dated when created. 
b. Marked with the highest classification of any information contained therein. 
c. Safeguarded as required for the assigned classification. 


d. Conspicuously marked “Working Paper” on the cover and/or first page of the document or 
material (or comparable location for special types of media) in letters larger than existing text. 


e. Destroyed in accordance with chapter 33 of title 44, U.S.C. (Reference (t)) as 
implemented by DoDD 5015.2 (Reference (u)) and appropriate DoD Component implementing 
directives and records schedules when no longer needed. 


f. Marked and controlled the same way as this Manual requires for finished products of the 
same classification when retained more than 180 days from date of origin (30 days for SAPs), 
filed permanently, e-mailed within or outside the originating activity, or released outside the 
originating activity, except as provided in paragraph 13.g. of this section. 


g. Shared between action officers, either physically or electronically, without controlling 
them as permanent documents only when: 


(1) The working materials are shared informally (e.g., collaborative documents or 
coordinating drafts) in the development process. 


(2) Transfer or transmission of the material is via secure means and, if electronic, by 
means other than e-mail. 


(3) All copies held by other than the originator are marked and controlled as required for 
finished products when retained more than 180 days of origin (30 days for SAPs). Consult with 
the originator for correct markings. 


14. EQUIPMENT USED FOR PROCESSING CLASSIFIED INFORMATION. The 
Department of Defense has a variety of non-COMSEC-approved equipment that is used to 
process classified information. This includes copiers, facsimile machines, computers and other 
IT equipment and peripherals, display systems, and electronic typewriters. Activities shall 
identify those features, parts, or functions of equipment used to process classified information 
that may retain all or part of the information. Activity security procedures shall prescribe the 
appropriate safeguards to: 
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a. Prevent unauthorized access to that information, including by repair or maintenance 
personnel. 


b. Ensure that repair procedures do not result in unauthorized dissemination of or access to 
classified information. Where equipment cannot be properly sanitized or appropriately 
knowledgeable escort provided, cleared maintenance technicians shall be used. Electronic repair 
or diagnostic equipment shall be maintained as classified material by the DoD Component if 
there is the potential for classified data transmission from the equipment being serviced. Use of 
remote diagnostic or repair capabilities shall be specifically approved and authorized in writing 
by the activity security manager; if the equipment retains or stores any classified information 
appropriate physical and logical protection must be provided on the remote end and secure 
communications are required. 


c. Replace and destroy equipment parts in the appropriate manner when classified 
information cannot be removed. Removable disk drives, memory chips and boards, and other 
electronic components of copiers, fax machines, etc. may be sanitized or destroyed in the same 
manner as used for comparable computer equipment. Alternatively, the equipment shall be 
designated as classified and be retained and protected accordingly. 


d. Ensure that appropriately knowledgeable, cleared personnel inspect equipment and 
associated media used to process classified information before the equipment is removed from 
protected areas to ensure there is no retained classified information. Classification markings and 
labels shall be removed from sanitized equipment and media after inspection, prior to removal 
from protected areas. 


e. Ensure computers and other equipment used to process classified information or to 
transmit classified information across a network are certified and accredited in accordance with 
Reference (s) as required by DoDI 8500.01 (Reference (v)). Measures to protect against 
compromising emanations shall be implemented in accordance with Reference (v). 


15. REPRODUCTION OF CLASSIFIED MATERIAL. Paper copies, electronic files, and other 
material containing classified information shall be reproduced only when necessary for 
accomplishing the organization’s mission or for complying with applicable statutes or Directives. 
Use of technology that prevents, discourages, or detects unauthorized reproduction of classified 
information is encouraged. 


a. Unless restricted by the originating agency, Top Secret, Secret, and Confidential 
information may be reproduced, including by e-mailing, scanning, and copying, to the extent 
operational needs require. 


b. The DoD Components shall establish procedures that facilitate oversight and control of 


the reproduction of classified information and the use of equipment for such reproduction, 
including controls that ensure: 
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(1) Reproduction is kept to a minimum consistent with mission requirements. 


(2) Personnel reproducing classified information are knowledgeable of the procedures 
for classified reproduction and aware of the risks involved with the specific reproduction 
equipment being used and the appropriate countermeasures they are required to take. 


(3) Reproduction limitations originators place on documents and special controls 
applicable to special categories of information are fully and carefully observed. 


(4) Reproduced material is placed under the same accountability and control 
requirements as applied to the original material. Extracts of documents will be marked 
according to content and may be treated as working papers if appropriate. 


(5) Reproduced material is conspicuously identified as classified at the applicable level 
and copies of classified material are reviewed after the reproduction process to ensure that the 
required markings exist. 


(6) Waste products generated during reproduction are protected and destroyed as 
required. 


(7) Classified material is reproduced only on approved and, when applicable, properly 
accredited systems. Section 14 of this enclosure provides additional guidance. 


(8) Foreign government information (FGT) is reproduced and controlled pursuant to 
guidance and authority granted by the originating government. 


16. CLASSIFIED MEETINGS AND CONFERENCES. Meetings and conferences involving 
classified information present special vulnerabilities to unauthorized disclosure. The Heads of 
the DoD Components shall establish specific requirements for protecting classified information 
at DoD Component-sponsored meetings and conferences, to include seminars, exhibits, 
symposia, conventions, training classes, workshops, or other such gatherings, during which 
classified information is disseminated. 


a. DoD Component approval processes shall ensure that the following requirements are met: 
(1) The meeting or conference serves a specified U.S. Government purpose. 


(2) Use of other approved methods or channels for disseminating classified information 
or material are insufficient or impractical. 


(3) The meeting or conference, or classified sessions thereof, takes place only at an 
appropriately cleared U.S. Government facility or a U.S. contractor facility that has an 
appropriate facility security clearance and, as required, secure storage capability, unless an 
exception is approved, in writing, in advance by the DoD Component Head or senior agency 
official. Such exception authority shall not be delegated below the senior agency official. 
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Requests for exceptions to permit use of facilities other than appropriately cleared U.S. 
Government or U.S. contractor facilities shall be submitted to the DoD Component Head or 
senior agency official in accordance with Component procedures. The request shall include a 
security plan that describes how the requirements of paragraphs 16.b and 16.d of this section 
shall be met. 


(a) If classified meetings or conferences occur at a cleared U.S. contractor location, 
the contractor shall comply with all applicable portions of DoD 5220.22-M (Reference (w)) and 
parts 120 through 130 of title 22, CFR (Reference (x)) (also known as “The International Traffic 
in Arms Regulations”). DoD approval for the conduct of the meeting does not constitute 
authorization for presentation of export-controlled information when foreign nationals attend. 


(b) The conduct of classified meetings or conferences at foreign installations and 
contractor sites is often subject to the rules and regulations of the host country, thus presenting 
additional security risks. Prior to approval of the conduct of such meetings, the DoD Component 
shall obtain assurances, in writing, that the responsible foreign government will agree to use 
security measures and controls that are at least as stringent as those required by this Manual. The 
provisions of paragraph 16.d. also shall be satisfied. To this end, assistance can be provided by 
the Director, International Security Programs, Defense Technology Security Administration, 
Office of the Under Secretary of Defense for Policy (OUSD(P)). 


(c) Routine day-to-day meetings and gatherings of DoD officials shall be conducted 
only at an appropriately cleared U.S. Government or contractor facility. Exceptions shall not be 
granted for routine meetings. 


(d) The provisions of this section do not apply to operational meetings conducted in 
combat situations, classes conducted by DoD schools, or gatherings of personnel of a DoD 
Component and foreign government representatives or U.S. and/or foreign contractor 
representatives on a matter related to a specific U.S. Government contract, program, or project. 


(4) Classified sessions are segregated from unclassified sessions. 


(5) Access to the meeting or conference, or specific sessions thereof, where classified 
information may be discussed or disseminated is limited to persons who possess an appropriate 
security clearance and need to know. 


(6) Any participation by foreign nationals or foreign representatives complies with 
requirements of Reference (q) and DoDD 5230.11 (Reference (y)) (e.g., the responsible U.S. 
Government foreign disclosure office(s) assures, in writing, that the information to be presented 
has been approved for disclosure to the represented foreign countries). 


(7) Announcement of the meeting or conference is unclassified and limited to a general 
description of topics expected to be presented, names of speakers, logistical information, and 


administrative and security instructions. 


(8) Procedures shall ensure that classified information, documents, recordings, 
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audiovisual material, information systems, notes, and other materials created, distributed, or used 
during the meeting are controlled, safeguarded, and transported as provisions of this Manual 
require. Recording or taking notes, including notes on classified electronic devices, during 
classified sessions shall be permitted only when it is determined that such action is necessary to 
fulfill the U.S. Government purpose for the meeting. 


(9) Information systems used during the meeting or conference to support creation or 
presentation of classified information shall meet all applicable requirements for processing 
classified information, including as appropriate considerations of technical security 
countermeasures (TSCM). Unclassified laptop computers, handheld information technologies 
(e.g., personal electronic devices (PEDs)), and other similar devices shall not be used for note 
taking during classified sessions. Use of classified computers and other electronic devices shall 
be permitted only when needed to meet the intent of the meeting or conference and appropriate 
protection and TSCM requirements have been met. 


b. The DoD activity sponsoring a classified meeting or conference shall assign an official to 
serve as security manager for the meeting and be responsible for ensuring that, at a minimum, the 
following security provisions are met: 


(1) Attendees are briefed on safeguarding procedures. 

(2) Entry is controlled so that only authorized personnel gain entry to the area. Particular 
caution shall be taken to ensure that any individual who is not authorized to attend the classified 
session(s) is denied entry thereto. 

(3) The perimeter is controlled to ensure unauthorized personnel cannot overhear 
classified discussions or introduce devices that would result in the compromise of classified 
information. 

(4) Escorts are provided for uncleared personnel who are providing services to the 
meeting or conference (e.g., setting up food or cleaning) when classified presentations and/or 


discussions are not in session. 


(5) Use of cell phones, PEDs, 2-way pagers, and other electronic devices that transmit is 
prohibited. 


(6) Classified notes and handouts are safeguarded in accordance with Enclosure 3. 


(7) Classified information is disclosed to foreign nationals only in accordance with the 
provisions of Reference (y). 


(8) An inspection of the room(s) is conducted at the conclusion of the meeting or 
conference (or at the end of each day of a multi-day event) to ensure all classified materials are 


properly stored. 


c. Appropriately cleared U.S. Government contractor personnel may provide administrative 
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support and assist in organizing a classified meeting or conference, but the DoD Component 
sponsoring the gathering remains responsible for all security requirements. 


d. Facilities other than appropriately cleared U.S. Government or U.S. contractor facilities 
proposed for use for classified meetings and conferences shall: 


(1) Not be open to the public and access shall be controlled by the U.S. Government or 
cleared contractor through a 100 percent identification card check at the perimeter point. For a 
military installation or comparably protected Federal government compound, this can be at the 
perimeter fence of the installation or compound. 


(2) Have the room(s) where the classified sessions are to be held located away from 
public areas so that access to the room(s), walls, and ceiling(s) can be completely controlled 
during the classified sessions. 


(3) Provide authorized means to secure classified information in accordance with 
Enclosure 3. 


(4) Meet the DoD antiterrorism standards specified by DoDI O-2000.16 (Reference (z)). 


(5) Be subject to TSCM surveys in accordance with DoDI 5240.05 (Reference (aa)). 
When addressing this requirement, TSCM security classification guidance MUST be consulted 
to ensure proper classification of meeting details when associated with the use of TSCM. 


e. Not later than 90 days following the conclusion of a classified meeting or conference for 
which an exception was granted, the sponsoring activity shall provide an after-action report to 
the DUSD([&S) through the approving DoD Component Head or senior agency official. The 
after-action report shall be a brief summary of any issues or threats encountered during the event 
and actions taken to address the situation. 


17. SAFEGUARDING FGI 


a. North Atlantic Treaty Organization (NATO) Information. NATO classified information 
shall be controlled and safeguarded according to United States Security Authority for NATO 
Instruction 1-07 (Reference (ab)). 


b. Other FGI. See the Glossary for the definition of FGI. 

(1) To avoid inadvertent compromise, classified FGI shall be stored in a manner that will 
avoid commingling with other material. For small volumes of material, separate files in the 
same vault, container, or drawer will suffice. 

(2) FGI shall be re-marked if needed to ensure the protective requirements are clear. 


FGI may retain its original classification if it is in English. However, when the foreign 
government marking is not in English, or when the foreign government marking requires a 
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different degree of protection than the same U.S. classification designation, a U.S. marking that 
results in a degree of protection equivalent to that required by the foreign government shall be 
applied. See Appendix 1 to Enclosure 4 of Volume 2 of this Manual for comparable U.S. 
classification designations. 


(3) U.S. documents containing FGI shall be marked as required by section 9 of 
Enclosure 4 of Volume 2 of this Manual. The foreign government document or authority on 
which derivative classification is based must be identified on the “Derived from:” line, in 
addition to the identification of any U.S. classification authority. A continuation sheet should be 
used for multiple sources, if necessary. A U.S. document containing FGI cannot be declassified 
or downgraded below the highest level of FGI contained in the document without the written 
permission of the foreign government or international organization that originated the 
information. 


(4) Security clearances issued by the U.S. Government are valid for access to classified 
FGI of a comparable level. 


(5) The transmission of FGI within the United States among U.S. Government agencies 
and U.S. contractors and between U.S. contractors with a need to know must be in accordance 
with this Manual and Reference (w). 


(6) The international transfer of foreign government classified information must be by 
government officials through government-to-government channels, or channels agreed upon in 
writing by the originating and receiving governments (collectively “government-to-government 
transfer”). See Enclosure 4 and its Appendix for further guidance on transfer of classified 
information. 


(7) The receiving DoD Components shall protect FGI to at least a degree equivalent to 
that required by the foreign government or international organization that provided the 
information. FGI shall be controlled and safeguarded in the same manner as prescribed for U.S. 
classified information, except as described below. The control and safeguarding requirements 
for FGI may be modified as permitted by a treaty or international agreement, or, for foreign 
governments with which there is no treaty or international agreement, through formal written 
agreement between the responsible national security authorities or designated security authorities 
of the originating and receiving governments (hereafter referred to collectively as designated 
security authorities (DSAs)). The Under Secretary of Defense for Policy (USD(P)) serves as the 
DSA. 


(a) Control of Foreign Government Top Secret Information. Maintain records for 
5 years of the receipt, internal distribution, destruction, annual inventory, access, reproduction, 


and transmittal of foreign government Top Secret information. Reproduction requires the 
consent of the originating government. Destruction shall be witnessed. 


(b) Control of Foreign Government Secret Information. Maintain records for 3 years 
of the receipt, distribution, external dispatch, reproduction, and destruction of material 
containing foreign government Secret information. Other records may be necessary if the 
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originator requires. Secret FGI may be reproduced to meet mission requirements. 


(c) Control of Foreign Government Confidential Information. Maintain records for 
2 years for the receipt and external dispatch of Confidential FGI. Do not maintain other records 


for foreign government Confidential information unless required by the originating government. 
Confidential FGI may be reproduced to meet mission requirements. 


(d) Foreign Government Restricted Information and Information Provided in 
Confidence. In order to ensure the protection of Restricted FGI or foreign government 
unclassified information provided in confidence, such information shall be classified in 
accordance with Reference (d) which states that unauthorized disclosure of FGI is presumed to 
cause damage to the national security. If the foreign protection requirement is lower than the 
protection required for U.S. Confidential information, the information shall be marked 
“CONFIDENTIAL-Modified Handling” as described in Volume 2, Enclosure 4, paragraph 4.c of 
this Manual and the following requirements shall also be met: 


1. The information shall be provided only to those individuals who have an 
established need to know, and where access is required by official duties. 


2. Individuals given access shall be notified of applicable handling instructions. 
This may be accomplished by a briefing, written instructions, or by applying specific handling 
requirements to an approved cover sheet. 


3. Documents shall be stored to prevent unauthorized access (e.g., a locked desk 
or cabinet or a locked room to which access is controlled). 


4. DoD Components and contractors performing on DoD contracts shall handle 
documents bearing the marking “UK RESTRICTED” as classified in accordance with 
subparagraph 17.b.(7)(d). The provision in the U.S./United Kingdom (UK) Security 
Implementing Arrangement (Reference (ac)) that allows documents marked “UK 
RESTRICTED?” to be handled in a manner similar to For Official Use Only (FOUO) information 
applies ONLY to DoD contactors operating under COMMERCIAL contracts with the UK and, 
pursuant to the agreement, the UK must include in the applicable contract its requirements for 
the marking and handling of the information. The provision does NOT apply to, nor permit, 
such handling of UK RESTRICTED information by DoD Components or by contractors when 
performing on DoD contracts. 


(8) FGI shall not be disclosed to nationals of third countries, including foreign nationals 
who are protected individuals or permanent resident aliens, or to any other third party, or used 
for other than the purpose for which the foreign government provided it without the originating 
government’s written consent. Questions regarding releasability or disclosure should be directed 
to the U.S. originator, who will consult with the foreign government as required. Contractors 
will submit their requests through the contracting U.S. Government agency for U.S. contracts 
and the Defense Security Service for direct commercial contracts. Approval from the originating 
government does not eliminate the requirement for the contractor to obtain an export 
authorization as required by other regulations or policies. 
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18. ALTERNATIVE COMPENSATORY CONTROL MEASURES (ACCM). A Head of a 
DoD Component with original classification authority (OCA) may employ ACCM when he or 
she determines that the standard security measures detailed in this Manual are insufficient to 
enforce need to know for classified information and SCI or SAP protections are not warranted. 
The use of an unclassified nickname, obtained in accordance with Chairman of the Joint Chiefs 
of Staff Manual (CJCSM) 3150.29C (Reference (ad)), together with a list of persons authorized 
access, and a specific description of information subject to the enhanced ACCM controls, are the 
three requisite elements of an ACCM. 


a. DoD Proponents for ACCM. The DoD staff proponent for ACCM management, 
oversight and Congressional reporting is the OUSD(P). The proponent for ACCM security 
policy is the Office of the Under Secretary of Defense for Intelligence and Security 
(OUSD(I&S)). Given this sharing of ACCM responsibilities, staff elements in OUSD(P) and 
OUSD(I&S) shall implement mechanisms that ensure transparency of all ACCM actions. 


b. ACCM Approval. A Head of a DoD Component may approve ACCM use for classified 
information over which they have cognizance. Prior to approving the establishment of an 
ACCM, the criticality, sensitivity, and value of the information; analysis of the threats both 
known and anticipated; vulnerability to exploitation; and a countermeasures cost benefits 
analysis shall be assessed. 


c. Guidance on ACCM Use. Use of ACCM must be consistent with the following guidance: 


(1) ACCM may be used to assist in enforcing need to know for classified DoD 
intelligence matters. The DoD Component Head establishing or terminating any such ACCM 
shall provide written notification within 30 days to the Director of Security, OUSD(I&S), and the 
Director, Special Programs, OUSD(P), who shall maintain this information as long as the ACCM 
is in use. 


(2) ACCM may be used to assist in enforcing need to know for classified operations, 
sensitive support, and other non-intelligence activities. The DoD Component Head establishing 
or terminating any such ACCM shall provide written notification within 30 days to the Director, 
Special Programs, OUSD(P), for review. The Director, Special Programs, OUSD(P), shall 
maintain this information as long as the ACCM is in use. 


(3) ACCM shall not be used for acquisition programs or activities progressing through 
the acquisition process. 


(4) DoD Components shall obtain an unclassified nickname consistent with Reference 
(ad) and coordinate with OUSD(P) to preclude duplication of nicknames. 


(5) A roster or listing of all persons accessed to the ACCM shall be maintained by the 
ACCM control officer (see subparagraph 18.f.(1)(c) of this section). The access roster will 
differentiate between those persons actively accessed and those whose accesses are currently 
inactive. 
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(6) ACCM documents and materials shall be marked as specified in Enclosure 4 of 
Volume 2 of this Manual. 


(7) Heads of DoD Components must establish and maintain a system that provides for 
recurrent inspection of the ACCM they have approved. This mechanism shall ensure compliance 
with the provisions of this Manual. Each ACCM shall be overseen and inspected on a recurrent 
basis by the ACCM sponsor or OUSD(P). 


d. Prohibited Security Measures. The application of the following security measures with 
ACCM material is prohibited: 


(1) Using personnel security investigative or adjudicative standards that are more 
stringent than those normally required for a comparable level of classified information to 
establish access eligibility to ACCM-protected information. 


(2) Using code words as defined in Reference (ad). 
(3) Using trigraphs, digraphs, or other abbreviations of the approved nickname. 


(4) Using specialized non-disclosure agreements or any certificates of disclosure or non- 
disclosure for ACCM access. 


(5) Using a billet structure or system to control the position or numbers of persons 
afforded ACCM access. 


e. Prohibited Uses of ACCM. The following uses of ACCM are prohibited: 


(1) Using ACCM for NATO or non-intelligence FGI. For NATO, exceptions to this 
limitation can be granted only by the Secretary of Defense. For non-intelligence FGI, 
exceptions to this limitation can be granted only by the USD(P). Request for exceptions shall be 
forwarded to the Director, International Security Programs, Defense Technology Security 
Administration, OUSD(P), for action. Such approvals must be documented and retained by the 
sponsor. 


(2) Using ACCM to protect classified information in acquisition programs as defined in 
DoDD 5000.01 (Reference (ae)). 


(3) Using ACCM to protect technical or operational requirements of systems in the 
acquisition process. Systems in operational use are not viewed as being in the acquisition 
process. Components of operational systems are fielded end items, not items in the acquisition 
process, and improvements to fielded items are eligible for ACCM status if properly justified. 


(4) Using ACCM to protect Restricted Data (RD), Formerly Restricted Data (FRD), 
COMSEC, SCI, SAP, or Nuclear Command and Control Extremely Sensitive Information. 
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(5) Using ACCM to protect unclassified information. 


(6) Using ACCM to preclude or impede congressional, OSD, or other appropriate 
oversight of programs, command functions, or operations. 


(7) Using ACCM to justify funding to procure or maintain a separate ACCM 
communication system. 


f. Documentation 


(1) Use of ACCM must be approved in writing by the cognizant DoD Component Head. 
The correspondence establishing the ACCM shall be signed by the DoD Component Head and 
shall include the following information: 


(a) Unclassified nickname assigned in accordance with Reference (ad). 


(b) Designation of the ACCM sponsor. As a minimum, the sponsor shall be a 
general or flag officer, or senior executive equivalent, who has OCA at the level of or higher 
than the information protected by the ACCM. 


(c) Designation of an ACCM control officer who shall be the organization’s point of 
contact for all matters concerning the ACCM. Subsequent changes in designated personnel shall 
be provided, in writing, to the Special Programs Office, OUSD(P). 


(d) Description of the essential information to be protected by the ACCM. 
(e) Effective activation date and expected ACCM duration. 
(f) Any planned participation by foreign partners. 


(2) The ACCM sponsor shall develop and distribute a program security plan, security 
classification guide, and program participant briefing to all participating organizations prior to 
the activation of the ACCM. As a minimum, the briefing will address the specific information 
that is subject to ACCM security measures. 


(3) The Special Programs Office, OUSD(P), shall maintain a central repository of 
records for all DoD ACCM. 


g. Annual Reports of ACCM Use. Not later than December 15 of each year, the DoD 
Components shall provide a report to OUSD(P) on all ACCM usage during the previous year. 
The exact format for this report shall be provided annually by OUSD(P), however, the general 
data elements include: ACCM nickname; purpose and/or description of the ACCM program; 
expected duration; and ACCM sponsor and ACCM control officer(s). 


h. Sharing ACCM-Protected Information. ACCM-protected information may be shared with 
other DoD Components and/or other Federal government departments and agencies only when 
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the recipient organization agrees to abide by the ACCM security requirements stipulated in this 
enclosure. 


i. Contractor Access to ACCM. DoD contractors may participate in ACCMs, or be directed 
to participate, only when such access and the associated security plan are identified in the DD 
Form 254, “Contract Security Classification Specification.” Care must be taken to ensure 
identification of the security plan does not disclose ACCM-protected data. 


j. Program Maintenance 


(1) ACCM sponsors shall maintain an updated listing of primary and alternate ACCM 
control officers for each organization to which they have extended their program. 


(2) Each organization’s ACCM control officer shall maintain an updated ACCM access 
control list for their organization. 


(3) Initial contact between organizations will be between each organization’s ACCM 
control officers. ACCM control officers may authorize action officer to action officer contact 
once access control lists have been exchanged between organizations. 


(4) Personnel requiring access to ACCM-protected information shall receive specialized 
training upon initial access to the program and annually thereafter. Training, as a minimum, 
shall address the procedures for access, control, transmission, storage, and marking. Individuals 
may be required to sign an acknowledgement of training should the security plan so specify. 


(5) ACCM documentation (i.e., program security plan and security classification guide) 
must be updated a minimum of once every 5 years. 


(6) ACCM sponsors shall provide the following information, through the DoD 
Component Head, to OUSD(P) concurrently with the ACCM annual report: 


(a) A listing of primary and alternate ACCM control officers for each organization 
managing an ACCM. 


(b) Any updated ACCM documentation or confirmation that program documentation 
has been reviewed and is current. 


k. Safeguarding ACCM Information. The provisions of this Manual regarding the 
safeguarding of classified information are modified with respect to use of ACCM as follows: 


(1) Top Secret, Secret, and Confidential cover sheets (i.e., SFs 703, 704, and 705, 
respectively) used to cover ACCM material shall be over stamped or marked with “ACCM” and 
the appropriate nickname. Cover sheets specifically designated by the DoD Components for use 
with ACCM must be approved by the Director of Security, OUSD(I&S), prior to use. 


(2) ACCM material should be handled and stored based on the security classification of 
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the information contained therein and in a manner that separates it from non-ACCM classified 
information. Separate GSA approved storage containers are not required so long as everyone 
with access to container is also approved for access to the ACCM material stored within, but the 
measures used (e.g., segregated files, separate folders, drawers labeled for ACCM) shall prevent 
the commingling of ACCM material with other classified documents. 


(3) ACCM information shall be transmitted in the same manner as other classified 
information at the same classification level with the following exceptions: 


(a) ACCM information packaged for transmission shall have the inner envelope 
marked with the appropriate classification, the caveat “ACCM,” and the assigned nickname, and 
shall be addressed to the attention of an individual authorized access to the ACCM information. 


(b) The ACCM nickname shall be used in the text of message traffic and on cover 
sheets accompanying secure facsimile transmissions to assist in alerting the recipient that the 
transmission involves ACCM-protected information. Senders shall ensure that an authorized 
recipient is awaiting the transmission when sending via secure facsimile. When using the 
Defense Message System (DMS), the material must also be marked as “SPECAT” (Special 
Category) in accordance with the requirements and procedures in CJCSM 5720.01B (Reference 
(af)). Due to limits in DMS processing, only one ACCM nickname should be used in a DMS 
message. 


(c) Automated information systems or electronic files containing ACCM protected 
information shall be configured with appropriate discretionary access controls to ensure that 
access is restricted to individuals with authorized access. 


(d) Secret Internet Protocol Router Network (SIPRNET) or other secure transmission 
methods authorized for processing information at the required level of classification may be used 
to transmit ACCM information. Each such transmission must be marked with the caveat 
“ACCM” and the authorized nickname in accordance with the marking guidance in Volume 2 
and transmitted only to those authorized access to the ACCM information. 


(e) The method of transmission selected for ACCM information, whether in 
hardcopy or electronic form, shall be consistent with the security classification assigned. 
Designation of information as requiring ACCM protection does not, in and of itself, require the 
transmission of the information by methods usually reserved for a higher level of classified 
information. 


l. Security Incidents. Compromise of ACCM program information can present an 
immediate and real threat to national security and those personnel involved in mission execution. 
Anyone finding ACCM material out of proper control shall take actions to safeguard the material 
and shall immediately notify the local ACCM control officer, if known, or the local security 
manager. 


(1) All reporting, inquiry, investigation, and damage assessment will be conducted per 
the guidelines contained in Enclosure 6 of this Volume. Any reports containing ACCM 
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information shall be handled in accordance with the requirements of this Manual as modified by 
this section. 


(2) Section 13 of Enclosure 6 of this Volume states the actions to take if unauthorized 
personnel are inadvertently afforded access to ACCM information. Inadvertent disclosure forms, 
commonly used with compartmented information, are not authorized for use with ACCM 
information. 


(3) Because ACCM program information is not SCI or SAP, reasonable risk 
management procedures should be followed when ACCM program information is incorrectly 
placed on non-approved electronic processing systems or electronically transmitted to non- 
authorized personnel and/or systems. Deleting the file or material from all affected systems is 
normally a sufficient action unless the material in question is classified at a higher level of 
classification than that for which the system is accredited. 


(4) The ACCM sponsor should be notified when the local inquiry and investigation is 
completed. Resolution will be in accordance with current guidance contained in Enclosure 6 of 
this Volume and must consider the guidance contained in the ACCM program security plan. 
Responsibility for the damage assessment remains with the ACCM sponsor. Any additional 
action will be as directed by the ACCM sponsor and the local security manager. 


m. ACCM Termination. ACCM shall be terminated by the establishing DoD Component 
when ACCM security measures are no longer required. Notification of ACCM termination must 
be submitted, in writing, as required by paragraphs 18.c.(1) and 18.c.(2) of this enclosure. 


n. Transitioning an ACCM to a SAP. If, at any point in time, the DoD Component Head 
determines that information protected by ACCM requires further protection as a SAP, 
authorization to establish a DoD SAP must be requested in accordance with DoD Directive 
5205.07 (Reference (ag)). 
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ENCLOSURE 3 


STORAGE AND DESTRUCTION 


1. GENERAL REQUIREMENTS 


a. Classified information shall be secured under conditions adequate to deter and detect 
access by unauthorized persons. The requirements specified in this Volume represent acceptable 
security standards. DoDD 5210.56 (Reference (ah)) specifies DoD policy concerning the use of 
force for the protection of classified information. Do not store weapons or items such as funds, 
jewels, precious metals, or drugs in the same container used to safeguard classified information. 
Holdings of classified material should be reduced to the minimum required to accomplish the 
mission. 


b. GSA establishes and publishes minimum standards, specifications, and supply schedules 
for containers, vault doors, modular vaults, alarm systems, and associated security devices 
suitable for storing and protecting classified information. DoDI 3224.03 (Reference (ai)) 
describes requirements for acquiring physical security equipment for use within the Department 
of Defense. 


c. The DNI establishes security requirements for sensitive compartmented information 
facilities (SCIFs). These are issued by Reference (i) within the Department of Defense. 


d. The DoD Lock Program is designated as the DoD technical authority for locking and 
storage systems used for the protection of classified information. For technical support, call the 
DoD Lock Program Technical Support Hotline at 1-800-290-7607 or DSN 551-1212 or review 
the website at https://locks.navfac.navy.mil, for more information. 


e. Volume 4 of this Manual specifies storage and destruction requirements for controlled 
unclassified information. 


2. LOCK SPECIFICATIONS. Except as provided elsewhere in this Volume, combination locks 
on vault doors, secure rooms, and security containers protecting classified information shall 
conform to Federal Specification FF-L-2740 (hereafter referred to as “FF-L-2740”)(Reference 


(aj). 


3. STORAGE OF CLASSIFIED INFORMATION BY LEVEL OF CLASSIFICATION. Store 
classified information not under the personal control and observation of an authorized person, in 
a locked security container, vault, room, or area, as specified in this section. 


a. Top Secret. Top Secret information shall be stored: 


(1) Ina GSA-approved security container with one of the following supplementary 
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controls: 


(a) An employee cleared to at least the Secret level shall inspect the security 
container once every 2 hours. 


(b) The location that houses the security container is protected by an intrusion 
detection system (IDS) meeting the requirements of the Appendix to this enclosure with 
personnel responding to the alarm arriving within 15 minutes of the alarm annunciation. 


(2) Ina GSA-approved security container equipped with a lock meeting FF-L-2740, 
provided the container is located within an area that has been determined to have security-in- 
depth (see Glossary for definition); 


(3) In an open storage area (also called a secure room) constructed according to the 
Appendix to this enclosure and equipped with an IDS with the personnel responding to an alarm 
within 15 minutes of the alarm annunciation if the area has been determined to have security-in- 
depth, or within 5 minutes of alarm annunciation if it has not; 


(4) Ina vault, or GSA-approved modular vault, meeting the requirements of Federal 
Standard (FED-STD) 832 (Reference (ak)) as specified in the Appendix to this enclosure; or 


(5) Under field conditions during military operations, using such storage devices or 
security control measures as a military commander deems adequate to prevent unauthorized 
access. Military commanders should employ risk management methodologies when determining 
appropriate safeguards. 


b. Secret. Secret information shall be stored by one of the following methods: 
(1) In the same manner as prescribed for Top Secret information; 


(2) Ina GSA-approved security container or vault built to FED-STD 832 specifications, 
without supplementary controls; 


(3) In an open storage area meeting the requirements of the Appendix to this enclosure, 
provided the senior agency official determines in writing that security-in-depth exists, and one of 
the following supplemental controls is utilized: 


(a) An employee cleared to at least the Secret level shall inspect the open storage 
area once every 4 hours. 


(b) An IDS meeting the requirements of the Appendix to this enclosure with the 
personnel responding to the alarm arriving within 30 minutes of the alarm annunciation. 


(4) In a secure room that was approved for the storage of Secret information by the DoD 


Component prior to October 1, 1995, provided the DoD Component reassesses the requirement 
for the secure room and makes plans to bring the room up to the standards of subparagraphs 
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3.b.(1) through 3.b.(3) of this section by October 1, 2013 and provided the area has been 
determined to have security-in-depth. 


c. Confidential. Confidential information shall be stored in the same manner as prescribed 
for Top Secret or Secret information except that supplemental controls are not required. 


4. RISK ASSESSMENT. When considering the storage alternatives specified in section 3, a 
risk assessment shall be performed to facilitate a security-in-depth determination and to aid 
identification and selection of supplemental controls that may need to be implemented. The 
analysis should, at a minimum, consider local threats, both known and anticipated, and 
vulnerabilities; the existing security environment and controls; the ease of access to containers or 
other areas where classified data is stored; the criticality, sensitivity, and value of the information 
stored; and cost verses benefits of potential countermeasures. The risk assessment shall be used 
to determine whether installation of an IDS is warranted or whether other supplemental controls 
are sufficient. 


5. U.S. CLASSIFIED INFORMATION LOCATED IN FOREIGN COUNTRIES. Except for 
classified information that has been authorized for release to a foreign government or 
international organization in accordance with Reference (y), and is under that government’s or 
organization’s security control, U.S. classified material may be retained and stored in a foreign 
country only when necessary to satisfy specific U.S. Government requirements. The Heads of 
the DoD Components shall prescribe requirements for protecting this information, paying 
particular attention to ensuring proper enforcement of controls on release of U.S. classified 
information to foreign entities. Compliance with the provisions of this enclosure is required. 
U.S. classified material in foreign countries shall be stored at a: 


a. U.S. military installation, or a location where the United States enjoys extraterritorial 
status, such as an embassy or consulate. 


b. U.S. Government activity located in a building used exclusively by U.S. Government 
tenants, provided the building is under continuous (i.e., 24/7) control by U.S. Government 
personnel. 


c. U.S. Government activity located in a building not used exclusively by U.S. Government 
tenants which is under host government control, provided that the classified material is stored in 
GSA-approved security containers which are further secured in a locked room or area to which 
only U.S. personnel have access and the room or area is under continuous (i.e., 24/7) control by 
U.S. Government personnel. 


d. U.S. Government activity located in a building not used exclusively by U.S. Government 
tenants nor under host-government control, provided the classified material is stored in GSA- 
approved security containers and is placed under continuous (i.e., 24/7) control by U.S. 
Government personnel. 
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6. SPECIALIZED STORAGE 


a. Military Platforms 


(1) The Heads of the DoD Components shall, consistent with this Volume, delineate the 
appropriate security measures required to protect classified information stored in security 
containers on military platforms (e.g., aircraft, militarized or tactical vehicle) and for classified 
munitions items. 


(2) GSA-approved field safes and special size one- and two-drawer security containers 
approved by the GSA may be used for storage of classified information in the field and in 
military platforms. These containers shall use locks conforming to FF-L-2740 or Federal 
Specification FF-L-2937 (Reference (al)), as required by Federal Specification AA-F-358 
(Reference (am)). Special size containers shall be securely fastened to the platform; field safes 
shall be under sufficient control and surveillance when in use to prevent unauthorized access or 
loss. 


b. IT Equipment. GSA-approved information processing system cabinets are available for 
protection of operational IT equipment. The cabinets can be used for storage of network 
equipment (such as routers, switches, and crypto devices), servers, power control units, and 
laptops and can be configured for rack mounting with interior fans for heat management and 
cable connections for exterior data transmission and power. 


c. Map and Plan File Cabinets. GSA-approved map and plan file cabinets are available for 
storing odd-sized items such as computer media, maps, charts, and classified equipment. 


d. Modular Vaults. GSA-approved modular vaults meeting Federal Specification AA-V- 
2737 (Reference (an)) may be used to store classified information as an alternative to vault 
requirements described in the Appendix to this enclosure. 


e. Bulky Material. Storage areas for bulky material containing Secret or Confidential 
information may have access openings (e.g., roof hatches, vents) secured by GSA-approved 
changeable combination padlocks meeting Federal Specification FF-P-110 (Reference (ao)). 
Other security measures are required, in accordance with paragraphs 3.b. and 3.c. of this 
enclosure. 


(1) When special circumstances exist, the Heads of the DoD Components may authorize 
the use of key operated locks for storing bulky material containing Secret and Confidential 
information. The authorization shall be documented with an explanation of the special 
circumstances that warrant deviation from other established standards. Whenever using such 
locks, administrative procedures for the control and accounting of keys and locks shall be 
established. The level of protection provided to such keys shall be equivalent to that afforded the 
classified information the padlock protects. 


(2) Section 1386 of title 18, United States Code (U.S.C.) (Reference (ap)), makes 
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unauthorized possession of keys, key-blanks, keyways, or locks that any part of the Department 
of Defense adopts for protecting conventional arms, ammunition, or explosives, special weapons, 
and classified equipment, a criminal offense punishable by fine or imprisonment for up to 

10 years, or both. 


7. PROCURING NEW STORAGE EQUIPMENT. New security storage equipment shall be 
procured from those items listed on the GSA Federal Supply Schedule. When GSA-approved 
security containers or vault doors with locks meeting FF-L-2740 are placed in service or when 
existing mechanical locks are replaced with locks meeting FF-L-2740, the custodian or security 
manager shall record the lock serial number on an SF 700, “Security Container Information.” 
For procurement or technical support, call the DoD Lock Program as specified in paragraph 1.d 
of this enclosure. 


8. SECURITY CONTAINER LABELS. GSA-approved security containers must have a label 
stating “General Services Administration Approved Security Container,” affixed to the front of 
the container, usually on the control or the top drawer. 


a. If the label is missing or if the container’s integrity is in question, the container shall be 
inspected by a GSA certified inspector. Information on obtaining inspections and recertification 
of containers can be found on the DoD Lock Program Website (https://locks.navfac.navy.mil) or 
by calling the DoD Lock Program at (800) 290-7607 or DSN 551-1212. 


b. When the container is being sent to the Defense Reutilization and Marketing Office, the 
GSA label shall be removed. 


9. EXTERNAL MARKINGS ON CONTAINERS. There shall be no external mark revealing 
the level of classified information authorized to be or actually stored in a given container or 
vault, or indicating the priority assigned to the container for emergency evacuation and 
destruction. This does not preclude placing a mark or symbol (e.g., a bar code) on the container 
for other purposes (e.g., identification and/or inventory purposes) or from applying decals or 
stickers the DNI requires for containers and equipment used to store or process intelligence 
information. If a GSA container or vault door recertification is required, such labels and 
markings must be removed, but may be reapplied as needed after recertification. 


10. SECURITY CONTAINER INFORMATION. Maintain a record for each container, or vault 
or secure room door, used for storing classified information. SF 700 with all information blocks 
completed, shall be used for this purpose. Update the form each time the security container 
combination is changed. 


a. Part 1 of SF 700 is not classified, but contains personally identifiable information (PID) 


that shall be protected by sealing Part 1 in an opaque envelope (not provided as part of the SF 
700) conspicuously marked “Security Container Information” and stored in accordance with SF 
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700 instructions. If the information must be accessed during non-duty hours and a new opaque 
envelope is not available to replace the opened one, the original envelope should be temporarily 
resealed, to the extent possible, until Part 1 can be placed in a new envelope the next working 
day. 


b. Part 2 of SF 700, when completed, is classified at the highest level of classification 
authorized for storage in the security container. It shall be sealed and stored in accordance with 
SF 700 instructions. The classification authority block shall state “Derived From: 32 CFR 
2001.80(d)(3)),” with declassification upon change of combination. 


11. COMBINATIONS TO CONTAINERS, VAULTS AND SECURE ROOMS 


a. Protecting and Storing Combinations. In accordance with section 2001.45(a)(1) of 
Reference (f), the combination shall be classified at the same level as the highest classification of 
the material authorized for storage in the container. 


(1) Use SF 700 Part 2, as specified in section 10 of this enclosure, to record the 
combination and other required data. 


(2) If another record of the combination is made, the record shall be marked as required 
by Volume 2 of this Manual. 


(3) Only a minimum number of authorized persons shall have knowledge of 
combinations to authorized storage containers, including vaults and secure rooms. 


(4) Security containers, vaults, secure rooms and other authorized storage containers 
shall be kept locked when not under the direct supervision of an authorized person entrusted with 
the contents. 


(5) A record of the names of persons having knowledge of the combination shall be 
maintained. 


b. Changing Combinations, Only individuals with the responsibility and an appropriate 
security clearance shall change combinations to security containers, vaults and secure rooms 
used for storing classified information. Combinations shall be changed: 


(1) When the container, vault, or secure room door is placed in service. 

(2) Whenever an individual knowing the combination to the container or vault door no 
longer requires access, unless other sufficient controls exist to prevent that individual’s access to 
the lock. 


(3) When compromise of the combination is suspected. 


(4) When the container, vault, or secure room door is taken out of service or is no longer 
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used to store classified information, at which time built-in combination locks shall be reset to the 
standard combination 50-25-50, and combination padlocks shall be reset to the standard 
combination 10-20-30. 


12. ENTRANCES TO OPEN STORAGE AREAS FOR CLASSIFIED INFORMATION 


a. When areas storing classified information are occupied by authorized individual(s), the 
entrances shall either be: 


(1) Under visual control at all times to detect entry by unauthorized persons; or 


(2) Equipped with an automated entry control system to limit access (see section 3 of the 
Appendix to this enclosure). 


b. Secure rooms or other areas storing classified information shall be secured when the area 
is not occupied by authorized individual(s) or under continual visual control. 


c. The Appendix to this enclosure provides standards for access control devices. Electrically 
actuated locks (e.g., magnetic strip card locks) do not, by themselves, meet the required 
standards for protecting classified information and shall not be used as a substitute for the locks 
prescribed in section 2 of this enclosure. 


13. INSPECTION OF STORAGE CONTAINERS PRIOR TO REMOVAL, REPAIR, ETC. 
Cleared personnel shall inspect storage containers that may have been used to store classified 
information before removing them from protected areas or allowing unauthorized persons access 
to them to ensure no classified material remains within. 


14. NEUTRALIZATION AND REPAIR PROCEDURES. The procedures described in FED- 
STD 809 (Reference (aq)) shall be followed for neutralization and repair of security containers 
and vault doors. Reference (aq) can be found on the DoD Lock Program Website, 
https://locks.navfac.navy.mil. 


a. Neutralization and repair of a security container or door to a vault approved for storage of 
classified information shall be accomplished only by appropriately cleared or continuously 
escorted personnel specifically trained in the methods specified by Reference (aq). 


b. Neutralization or repair by, or using, methods and procedures other than described in 
Reference (aq) is considered a violation of the security container’s or vault door’s security 
integrity and the GSA label shall be removed. Thereafter, the containers or doors may not be 
used to protect classified information. 


15. STORAGE OF FGI. To the extent practical, FGI shall be stored separately from other 
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information to facilitate its control. To avoid additional costs, separate storage may be 
accomplished by methods such as using separate drawers in the same container as other 
information or, for small amounts, the use of separate file folders in the same drawer. 


16. RETENTION OF CLASSIFIED INFORMATION. Classified documents and other material 
shall be retained within DoD organizations only if they are required for effective and efficient 
operation of the organization or if law or regulation requires their retention. Documents no 
longer required for operational purposes shall be disposed of according to the provisions of 
chapter 33 of Reference (t) and appropriate implementing directives and records schedules, and 
in accordance with sections 17 and 18 of this enclosure. 


17. DESTRUCTION OF CLASSIFIED INFORMATION. Classified documents and material 
identified for destruction shall be destroyed completely, to prevent anyone from reconstructing 
the classified information, according to procedures and methods the DoD Component Head 
prescribes. Methods and equipment used to routinely destroy classified information include 
burning, crosscut shredding, wet pulping, mutilation, chemical decomposition or pulverizing. 
Methods used for clearing, sanitization or destruction of classified IT equipment and media 
include overwriting, degaussing, sanding, and physical destruction of components or media. 


a. Documents and other material identified for destruction shall continue to be protected as 
appropriate for their classification until actually destroyed. 


b. Each activity with classified holdings shall establish at least 1 day each year when specific 
attention and effort is focused on disposing of unneeded classified material (“clean-out day”). 


c. Guidance on standards, processes, and procedures for the destruction of COMSEC and 
other classified material can be found in Reference (r). NATO material shall be destroyed in 
accordance with Reference (ab). FGI shall be destroyed in the same manner as U.S. classified 
information of the equivalent level, except where otherwise required by international treaty or 
agreement. Also see Enclosure 2, subparagraphs 17.b.(7)(a) through (d) for guidance on 
recording FGI destruction. 


d. Effective January 1, 2011, only equipment listed on an evaluated products list (EPL) 
issued by NSA may be used to destroy classified information using any method covered by an 
EPL. EPLs currently exist for paper shredders, punched tape destruction devices, optical media 
destruction devices (for compact discs (CDs) and digital video discs (DVDs)), degaussers (for 
magnetic media sanitization), and disintegrators (for paper and punched tape material). The EPLs 
may be obtained by calling (410) 854-6358 or at 
http://www.nsa.gov/ia/guidance/media_destruction_guidance/index.shtml. 


(1) Equipment approved for use prior to January 1, 2011, and not found on the 
appropriate EPL may be used for destruction of classified information until December 31, 2016. 


(2) Unless determined otherwise by NSA, whenever an EPL is revised, equipment 
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removed from the EPL may be utilized for destruction of classified information for up to 6 years 
from the date of its removal from the EPL. 


(3) In all cases, if any such previously approved equipment needs to be replaced or 
otherwise requires a rebuild or replacement of a critical assembly (e.g., shredder blade 
assembly), the unit must be replaced with one listed on the appropriate EPL. 


e. Classified IT storage media (e.g., hard drives) cannot be declassified by overwriting. 
Sanitization (which may destroy the usefulness of the media) or physical destruction is required 
for disposal. See also section 6 of Enclosure 7 of this Volume. 


18. TECHNICAL GUIDANCE ON DESTRUCTION METHODS. Contact the National 
Security Agency/Central Security Service (NSA/CSS) System and Network Analysis Center at 
(410) 854-6358 or via e-mail at SNAC@radium.ncsc.mil, to obtain technical guidance 
concerning appropriate methods, equipment, and standards for destroying classified electronic 
media, IT equipment, electronic components, and other similar or associated materials. 


a. Crosscut Shredders. Only crosscut shredders listed on the “NSA/CSS Evaluated Products 
List for High Security Crosscut Paper Shredders” (Reference (ar)) may be used to destroy 
classified material by shredding. 


(1) The EPL is updated on an as-needed basis as new models are successfully evaluated. 
Users are encouraged to contact shredders manufacturers and/or distributors for assistance in 
selecting unit(s) best suited to their requirements. Vendors and/or distributors can provide 
guidance on whether a specific model not listed meets the specifications in Reference (ar) (e.g., 
for shred size) and, as applicable, a copy of the NSA/CSS letter confirming that the model will 
be included on the EPL at its next update. 


(2) Crosscut shredders currently in use and not on the EPL that were at the time of 
acquisition on a NSA/CSS evaluated approved products list as being capable of maintaining a 
shred size of 1/2 inch by 1/32 inch (variance of 1/64 inch) may be used until December 31, 2016 
in accordance with paragraph 17.d of this enclosure, EXCEPT for destruction of COMSEC 
materials. However, any such crosscut shredders requiring replacement of the unit and/or 
rebuild of the shredder blades assembly MUST BE REPLACED by a crosscut shredder on the 
latest NSA/CSS EPL. When COMSEC material is destroyed by shredding, ONLY crosscut 
shredders listed in Reference (ar) at the time of acquisition shall be used. 


(a) Pending replacement, the Heads of DoD Components shall ensure that procedures 
are in place to manage the risk posed by crosscut shredders not on the approved NSA/CSS list. 
At a minimum, the volume and content of each activity’s classified material destruction flow 
shall be assessed and a process established to optimize the use of high security crosscut paper 
shredders (i.e., with top secret collateral material being the highest collateral priority) to take full 
advantage of the added security value of those shredders. 


(b) The bag of shred must be “stirred” to ensure that the content is mixed up. 
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(c) Shredding of unclassified material along with the classified material is 
encouraged. 


b. Pulverizers and Disintegrators. Pulverizers and disintegrators must have a 3/32 inch or 
smaller security screen. Consult the “NSA/CSS Evaluated Products List for High Security 
Disintegrators” (Reference (as)) for additional details and guidance. 


c. Pulping. Pulping (wet process) devices with a 1/4 inch or smaller security screen may be 
used to destroy classified water-soluble material. 


19. DESTRUCTION PROCEDURES 


a. The Heads of the DoD Component shall establish procedures to ensure that all classified 
information intended for destruction is destroyed by authorized means and appropriately cleared 
personnel. 


b. Classified information that cannot be destroyed shall be reevaluated and, when 
appropriate, downgraded, declassified, or retired to a designated record center. 


c. Classified information shall be controlled in a manner designed to minimize the 
possibility of unauthorized removal and/or access. A burn bag may be used to store classified 
information awaiting destruction at a central destruction facility. Seal and safeguard each burn 
bag per this Volume until actually destroyed. 


d. Records of destruction are not required, except as noted in paragraph 17.c of this 
enclosure and, for destruction of classified FGI, in Enclosure 2, subparagraphs 17.b.(7)(a) 
through (d). 


Appendix 
Physical Security Standards 


Change 3, 07/28/2020 44 ENCLOSURE 3 


14 


DoDM 5200.01-V3, February 24, 2012 


APPENDIX TO ENCLOSURE 3 


PHYSICAL SECURITY STANDARDS 


1. VAULT AND SECURE ROOM CONSTRUCTION STANDARDS 


a. Vaults. Vaults shall be constructed to meet Reference (ak) as follows: 
(1) Class A (concrete poured-in-place). 
(2) Class B (GSA-approved modular vault meeting Reference (an) specifications). 
(3) Class C (steel-lined vault) is NOT authorized for protection of classified information. 


b. Open Storage Area (Secure Room). This section provides the minimum construction 
standards for open storage areas. 


(1) Walls, Floor, and Roof. Walls, floor, and roof shall be of permanent construction 
materials; i.e., plaster, gypsum wallboard, metal panels, hardboard, wood, plywood, or other 
materials offering resistance to and evidence of unauthorized entry into the area. Walls shall be 
extended from the true floor to the true ceiling and attached with permanent construction 
materials, mesh, or 18 gauge expanded steel screen. 


(2) Ceiling. The ceiling shall be constructed of plaster, gypsum, wallboard material, 
hardware or any other acceptable material. 


(3) Doors. Access doors shall be substantially constructed of wood or metal. For out- 
swing doors, hinge-side protection shall be provided by making hinge pins non-removable (e.g., 
spot welding) or by using hinges with interlocking leaves that prevent removal. Doors shall be 
equipped with a GSA-approved combination lock meeting FF-L-2740. Doors other than those 
secured with locks meeting FF-L-2740 shall be secured from the inside with deadbolt emergency 
egress hardware, a deadbolt, or a rigid wood or metal bar that extends across the width of the 
door. 


(4) Windows 


(a) Windows that are less than 18 feet above the ground measured from the bottom of 
the window, or are easily accessible by means of objects located directly beneath the windows, 
shall be constructed from or covered with materials that will provide protection from forced 
entry. The protection provided to the windows need be no stronger than the strength of the 
contiguous walls. Secure rooms which are located within a controlled compound or equivalent 
may eliminate the requirement for forced entry protection if the windows are made inoperable 
either by permanently sealing them or equipping them on the inside with a locking mechanism 
and they are covered by an IDS (either independently or by motion detection sensors within the 
area). 
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(b) Windows, which might reasonably afford visual observation of classified 
activities within the facility shall be made opaque or equipped with blinds, drapes, or other 
coverings. 


(5) Utility Openings. Utility openings such as ducts and vents shall be smaller than man- 
passable (96 square inches). An opening larger than 96 square inches (and over 6 inches in its 
smallest dimension) that enters or passes through an open storage area shall be hardened in 
accordance with Military Handbook 1013/1A (Reference (at)). 


2. IDS STANDARDS 


a. IDS Purpose. An IDS shall detect an unauthorized penetration into the secured area. An 
IDS shall be installed when results of a documented risk assessment determine its use as a 
supplemental control is warranted, in accordance with Enclosure 3, sections 3 and 4 of this 
Volume, and use is approved by the activity head. When used, all areas that reasonably afford 
access to the security container or areas where classified data is stored shall be protected by IDS 
unless continually occupied. An IDS complements other physical security measures and consists 
of: 


(1) Intrusion detection equipment (IDE). 
(2) Security forces. 
(3) Operating procedures. 


b. System Functions 


(1) IDS components operate as a system with four distinct phases: 
(a) Detection. 
(b) Communications. 
(c) Assessment. 
(d) Response. 


(2) These elements are equally important, and none can be eliminated if an IDS is to 
provide an acceptable degree of protection. 


(a) Detection. During the detection phase, a detector or sensor senses and reacts to 
the stimuli it is designed to detect. The sensor alarm condition is then transmitted over cabling 
located within the protected area to the premise control unit (PCU). The PCU may service many 
sensors. The PCU and the sensors it serves comprise a zone at the monitor station (i.e., an 
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alarmed zone). 


(b) Communications. The PCU receives signals from all sensors in a protected area 
and incorporates these signals into a communication scheme. An additional signal is added to 
the communication for supervision to prevent compromise of the communication scheme (i.e., 
tampering or injection of false information by an intruder). The supervised signal is sent by the 
PCU through the transmission link to the monitor station. Inside the monitor station either a 
dedicated panel or central processor monitors information from the PCU signals. When an alarm 
occurs, an annunciator generates an audible and visible alert to security personnel. Alarms result 
normally from intrusion, tampering, component failure, or system power failure. 


(c) Assessment. The assessment period is the first phase that requires human 
interaction. When alarm conditions occur, the operator assesses the situation and dispatches the 
response force. 


(d) Response. The response phase begins as soon as the operator assesses an alarm 
condition. A response force shall immediately respond to all alarms. The response phase shall 
also determine the precise nature of the alarm and take all measures necessary to safeguard the 
secure area. 


c. Acceptability of Equipment: All IDE must be Underwriters Laboratories (UL)-listed (or 
equivalent) and approved by the DoD Component. Government installed, maintained, or 
furnished systems are acceptable. 


d. Transmission and Annunciation 


(1) Transmission Line Security. When the transmission line leaves the facility and 
traverses an uncontrolled area, Class I or Class II line supervision shall be used. 


(a) Class I. Class I security is achieved through the use of Data Encryption Standard 
or an algorithm based on the cipher feedback or cipher block chaining mode of encryption. 
Certification by the National Institutes of Standards and Technology or another independent 
testing laboratory is required. 


(b) Class II. Class II line supervision refers to systems in which the transmission is 
based on pseudo-random generated tones or digital encoding using an interrogation and response 
scheme throughout the entire communication, or UL Class AA line supervision. The signal shall 
not repeat itself within a minimum 6-month period. Class II security shall be impervious to 
compromise using resistance, voltage, current, or signal substitution techniques. 


(2) Internal Cabling. The cabling between the sensors and the PCU shall be dedicated to 
IDE and shall comply with national and local code standards. 


(3) Entry and/or Access Control Systems. If an entry and/or access control system is 
integrated into an IDS, reports from the automated entry and/or access control system shall be 
subordinate in priority to reports from intrusion alarms. 
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(4) Maintenance Mode. When the alarm zone is placed in the maintenance mode, this 
condition shall be signaled automatically to the monitor station. The signal shall appear as an 
alarm or maintenance message at the monitor station and the IDS shall not be securable while in 
the maintenance mode. The alarm or message shall be continually visible at the monitor station 
throughout the period of maintenance. A standard operating procedure shall be established to 
address appropriate actions when maintenance access is indicated at the panel. All maintenance 
periods shall be archived in the system. A self-test feature shall be limited to one second per 
occurrence. 


(5) Annunciation of Shunting or Masking Condition. Shunting or masking of any 
internal zone or sensor shall be appropriately logged or recorded in archive. A shunted or 


masked internal zone or sensor shall be displayed as such at the monitor station throughout the 
period the condition exists whenever there is a survey of zones or sensors. 


(6) Indications of Alarm Status. Indications of alarm status shall be revealed at the 
monitoring station and optionally within the confines of the secure area. 


(7) Power Supplies. Primary power for all IDE shall be commercial alternating or direct 
current (AC or DC) power. In the event of commercial power failure at the protected area or 
monitor station, the equipment shall change power sources without causing an alarm indication. 


(a) Emergency Power. Emergency power shall consist of a protected independent 
backup power source that provides a minimum of 8 hours operating power battery and/or 
generator power. When batteries are used for emergency power, they shall be maintained at full 
charge by automatic charging circuits. The manufacturer’s periodic maintenance schedule shall 
be followed and results documented. 


(b) Power Source and Failure Indication. An illuminated indication shall exist at the 
PCU of the power source in use (AC or DC). Equipment at the monitor station shall indicate a 
failure in power source, a change in power source, and the location of the failure or change. 


(8) Component Tamper Protection. IDE components located inside or outside the secure 
area shall be evaluated for a tamper protection requirement. If access to a junction box or 
controller will enable an unauthorized modification, tamper protection shall be provided. 


e. System Requirements 


(1) Independent Equipment. When many alarmed areas are protected by one monitor 
station, secure room zones shall be clearly distinguishable from the other zones to facilitate a 
priority response. All sensors shall be installed within the protected area. 


(2) Access and/or Secure Switch and PCU. No capability shall exist to allow changing 
the access status of the IDS from a location outside the protected area. All PCUs shall be located 
inside the secure area and should be located near the entrance. Assigned personnel shall initiate 
all changes in access and secure status. Operations of the PCU may be restricted by use of a 
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device or procedure that verifies authorized use. In the secure mode, any unauthorized entry into 
the space shall cause an alarm to be transmitted to the monitor station. 


(3) Motion Detection Protection. Secure areas that reasonably afford access to the 
security container or area where classified data is stored shall be protected with motion detection 
sensors; e.g., ultrasonic and passive infrared. Use of dual technology is authorized when one 
technology transmits an alarm condition independently from the other technology. A failed 
detector shall cause an immediate and continuous alarm condition. 


(4) Protection of Perimeter Doors. When an IDS is installed, each perimeter door shall 
be protected by a balanced magnetic switch that meets UL Standard 634 (Reference (au)). 


(5) Windows. All readily accessible windows (within 18 feet of ground level) shall be 
protected by an IDS, either independently or by the motion detection sensors within the space, 
whenever a secure room is located within a controlled compound or equivalent and forced entry 
protection of the windows is not provided (also see subparagraph 1.b.(4) of this Appendix). 


(6) IDS Requirements for Continuous Operations Facilities. A continuous operation 
facility may not require an IDS. This type of secure area should be equipped with an alerting 
system if the occupants cannot observe all potential entrances into the room. Duress devices 
may also be required. 


(7) False and/or Nuisance Alarm. Any alarm signal transmitted in the absence of 
detected intrusion that is not identified as a nuisance alarm is a false alarm. A nuisance alarm is 
the activation of an alarm sensor by some influence for which the sensor was designed but which 
is not related to an intrusion attempt. All alarms shall be investigated and the results 
documented. The maintenance program for the IDS shall ensure that incidents of false and/or 
nuisance alarms shall not exceed 1 in a period of 30 days per zone. 


f. Installation, Maintenance and Monitoring 


(1) IDS Installation and Maintenance Personnel. Alarm installation and maintenance 
shall be accomplished by U.S. citizens who have been subjected to a trustworthiness 
determination according to Reference (1). 


(2) Monitor Station Staffing. The monitor station shall be supervised continuously by 
U.S. citizens who have been subjected to a trustworthiness determination according to 
Reference (1). 


3. ACCESS CONTROLS 


a. The perimeter entrance to a secure facility (i.e., vault or secure room) shall be under 
control at all times during working hours to prevent entry by unauthorized personnel. This may 
be achieved by visual control or through use of an automated entry control system (AECS) that 
complies with the requirements of subparagraph 3.a.(2) of this section. Uncleared persons are to 
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be escorted within the facility by a cleared person who is familiar with the security procedures of 
the facility. Personnel entering or leaving an area shall be required to secure the entrance or exit 
point. Authorized personnel who permit another individual to enter the area are responsible for 
confirming their need to know and access. 


(1) Visual control may be accomplished by methods such as designated employees, 
guards, or continuously monitored closed circuit television. 


(2) An AECS may be used if it meets the criteria stated in subparagraphs 3.a.(2)(a) and 
3.a.(2)(b). The AECS shall identify an individual and authenticate the person’s authority to enter 
the area through the use of an identification (ID) badge or card. 


(a) The ID badge or key card shall use embedded sensors, integrated circuits, 
magnetic stripes, or other means of encoding data that identifies the facility and the individual to 
whom the card is issued. 


(b) Biometrics verification identifies the individual requesting access by some unique 
personal characteristic and may be required for access to sensitive information. The Biometrics 
Identity Management Agency can provide further information regarding biometric technologies 
and capabilities. Personal characteristics that can be used for identity verification include: 


1. Fingerprints. 

2. Hand geometry. 
3. Handwriting. 

4. Iris scans. 

5. Voice. 

6. Facial recognition. 

(3) In conjunction with subparagraph 3.a.(2)(a) of this section, a personal identification 
number (PIN) may be required. The PIN shall be separately entered into the system by each 
individual using a keypad device and shall consist of four or more digits, randomly selected, with 
no known or logical association with the individual. The PIN shall be changed when it is 
believed to have been compromised or subjected to compromise. 

(4) Authentication of the individual’s authorization to enter the area shall be 
accomplished within the system by inputs from the ID badge and/or card, the personal identity 
verification device, or the keypad with an electronic database of individuals authorized to enter 
the area. A procedure shall be established for removing the individual’s authorization to enter 


the area upon reassignment, transfer, or termination, or when the individual’s access is 
suspended, revoked, or downgraded to a level lower than the required access level. 
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(5) Protection shall be established and maintained for all devices or equipment that 
constitutes the entry control system. The level of protection may vary depending upon the type 
of device or equipment being protected. 


(a) Location where authorization data and personal identification or verification data 
is input, stored, or recorded shall be protected. 


(b) Card readers, keypads, communication or interface devices located outside the 
entrance to a controlled area shall have tamper resistant enclosures and be securely fastened to 
the wall or other permanent structure. Control panels located within a controlled area shall 
require only a minimal degree of physical security protection sufficient to preclude unauthorized 
access to the mechanism. 


(c) Keypad devices shall be designed or installed in such a manner that an 
unauthorized person in the immediate vicinity cannot observe the selection of input numbers. 


(d) Systems that use transmission lines to carry access authorizations, personal 
identification data, or verification data between devices or equipment located outside the 
controlled area shall have line supervision. 


(e) Electric strikes used in access control systems shall be heavy duty, industrial 
grade. 


(6) Access to records and information concerning encoded identification data and PINs 
shall be restricted. Access to identification or authorizing data, operating system software or any 
identifying data associated with the entry control system shall be limited to the fewest number of 
personnel as possible. Such data or software shall be kept secure when unattended. 


(7) Records shall be maintained reflecting active assignment of identification badge 
and/or card, PIN, level of access, and similar system-related records. Records concerning 
personnel removed from the system shall be retained for at least 90 days. Records of entries 
shall be retained for at least 90 days or until investigations of system violations and incidents 
have been resolved and recorded. Such records shall be destroyed when no longer required in 
accordance with Reference (u) and DoD Component implementing directives and records 
schedules. 


b. The Heads of DoD Components may approve the use of standardized AECS that meet the 
following criteria: 


(1) For a Level 1 key card system, i.e., a key card bearing a magnetic stripe, the AECS 
shall provide a .95 probability of granting access to an authorized user providing the proper 
identifying information within three attempts. In addition, the system shall ensure an 
unauthorized user is granted access with less than 0.05 probability after three attempts to gain 
entry. 


(2) For a Level 2 key card and PIN system, i.e., a key card bearing a magnetic stripe 
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used in conjunction with a PIN, the AECS shall provide a 0.97 probability of granting access to 
an authorized user providing the proper identifying information within three attempts. In 
addition, the system must ensure an unauthorized user is granted access with less than 0.010 
probability after three attempts to gain entry have been made. 


(3) For a Level 3 key card, i.e., a key card bearing a magnetic stripe used in conjunction 
with a PIN and biometrics identifier system, the AECS shall provide a 0.97 probability of 
granting access to an authorized user providing the proper identifying information within three 
attempts. In addition, the system shall ensure an unauthorized user is granted access with less 
than 0.005 probability after three attempts to gain entry have been made. 


c. Electrical, mechanical, or electromechanical access control devices meeting the criteria 
stated below, may be used to control access to secure areas during duty hours if the entrance is 
under visual control. These devices are also acceptable to control access to compartmented areas 
within a secure area. Access control devices shall be installed in the following manner: 


(1) The electronic control panel containing the mechanism for setting the combination 
shall be located inside the area. The control panel shall require only a minimal degree of 
physical security designed to preclude unauthorized access to the mechanism. 


(2) The control panel shall be installed, or have a shielding device mounted, so that an 
unauthorized person in the immediate vicinity cannot observe the setting or changing of the 
combination. 


(3) An individual cleared at the same level as the highest classified information 
controlled within the area shall select and set the combination. 


(4) Electrical components, including wiring, or mechanical links (cables, rods, and so 


on) shall be accessible only from inside the area, or, if they traverse an uncontrolled area, they 
shall be secured within conduit to preclude surreptitious manipulation of components. 
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ENCLOSURE 4 


TRANSMISSION AND TRANSPORTATION 


1. TRANSMISSION AND TRANSPORTATION PROCEDURES. Heads of the DoD 
Components shall establish procedures for transmitting and transporting classified information 
that maximizes the accessibility of classified information to individuals who are eligible for 
access thereto and minimizes the risk of compromise while permitting the use of the most cost- 
effective means. Persons transmitting or transporting classified information are responsible for 
ensuring that the intended recipient(s) are authorized access, have a need to know, and have the 
capability to store classified information in accordance with the requirements of this Manual. 


a. COMSEC information shall be transmitted and transported according to NSA/CSS Policy 
Manual 3-16 (Reference (av)). 


b. NATO classified information, including NATO Restricted, shall be transmitted according 
to the requirements of Reference (ab). 


2. DISSEMINATION OUTSIDE THE DEPARTMENT OF DEFENSE 


a. Classified information originating in another DoD Component or in a department or 
agency other than the Department of Defense may be disseminated to other DoD Components, to 
other U.S. departments or agencies, or to a U.S. entity without the consent of the originating 
Component, department, or agency, as long as: 


(1) The criteria for access in section 3 of Enclosure 2 of this Volume are met. 


(2) The classified information is NOT marked as requiring prior authorization for 
dissemination to another department or agency. The marking “ORCON” may be used to identify 
information requiring prior authorization for dissemination to another department or agency. 


(3) The document was created ON or AFTER June 27, 2010, the effective date of 
Reference (f) (however, also see paragraph 2.b of this section). 


b. Documents created BEFORE June 27, 2010 may not be disseminated outside of the 
Department of Defense without the originator’s consent. Additionally, documents created on or 
after June 27, 2010, whose classification is derived from documents created prior to that date, 
and where the date before June 27, 2010 of the classified source(s) is readily apparent from the 
source list, shall not be disseminated outside of the Department of Defense without the 
originator’s consent. 


c. Classified information originating in, or provided to or by, the Department of Defense 


may be disseminated to a foreign government or an international organization of governments, or 
any element thereof, in accordance with References (d), (f) and (y). See section 6 of this 
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enclosure for further guidance. 


d. Dissemination of information regarding intelligence sources, methods, or activities shall 
be consistent with directives issued by the DNI. 


e. Dissemination of classified information to state, local, tribal and private sector officials 
pursuant to E.O. 13549 (Reference (aw)) shall be in accordance with implementing guidance 
issued by the Department of Homeland Security. 


3. TRANSMISSION OF TOP SECRET INFORMATION. Top Secret information shall be 
transmitted only by: 


a. Direct contact between appropriately cleared persons. 


b. Electronic means over an approved secure communications system (i.e., a cryptographic 
system authorized by the Director, NSA, or a protected distribution system designed and 
installed to meet the requirements of National Security Telecommunications and Information 
Systems Security Instruction (NSTISSI) 7003 (Reference (ax))). This applies to voice, data, 
message (both organizational and e-mail), and facsimile transmissions. 


c. The Defense Courier Service (DCS) if the material qualifies under the provisions of DoDI 
5200.33 (Reference (ay)). The DCS may use a specialized shipping container as a substitute for 
a DCS courier on direct flights if the shipping container is sufficiently constructed to provide 
evidence of forced entry, secured with a high security padlock meeting Reference (ao) 
specifications and equipped with an electronic seal that would provide evidence of surreptitious 
entry. A DCS courier shall escort the specialized shipping container to and from the aircraft and 
oversee its loading and unloading. This authorization also requires that the DCS develop 
procedures that address protecting specialized shipping containers in the event a flight is diverted 
for any reason. 


d. Authorized U.S. Government agency courier services (e.g., Department of State 
Diplomatic Courier Service, authorized DoD Component courier service). 


e. Appropriately cleared U.S. Military and Government civilian personnel specifically 
designated to carry the information and traveling by surface transportation. 


f. Appropriately cleared U.S. Military and Government civilian personnel specifically 
designated to carry the information and traveling on scheduled commercial passenger aircraft 
within and between the United States, its territories, and Canada. 

g. Appropriately cleared U.S. Military and Government civilian personnel specifically 
designated to carry the information and traveling on scheduled commercial passenger aircraft on 


flights outside the United States, its territories, and Canada. 


h. DoD contractor employees with appropriate clearances traveling within and between the 
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United States and its territories provided the requirements of Reference (w) and Volume 2 of 
DoD Manual 5220.22 (Reference (az)) are met. 


4. TRANSMISSION OF SECRET INFORMATION. Secret information may be transmitted 
by: 


a. Any of the means approved for the transmission of Top Secret information. 


b. Appropriately cleared contractor employees if the transmission meets the requirements 
specified in References (w) and (az). 


c. Overnight delivery, provided the requirements of this paragraph are met. Heads of DoD 
Components may, when a requirement exists for overnight delivery to a DoD Component within 
the United States and its territories, authorize the use of the current holder of the GSA contract 
for overnight delivery of information for the Executive Branch as long as applicable postal 
regulations (chapter I of title 39, CFR (Reference(ba))) are met. Any such delivery service shall 
be U.S. owned and operated, provide automated in-transit tracking of the classified information, 
and ensure package integrity during transit. The contract shall require cooperation with U.S. 
Government inquiries in the event of a loss, theft, or possible compromise. The sender is 
responsible for ensuring that an authorized person at the receiving end is aware that the package 
is coming and will be available to receive the package, verifying the mailing address is correct, 
and confirming (by telephone or e-mail) that the package did in fact arrive within the specified 
time period. The package may be addressed to the recipient by name. The release signature 
block on the receipt label shall not be executed under any circumstances. The use of external 
(street side) collection boxes is prohibited. Classified COMSEC information, NATO 
information, SCI, and FGI shall not be transmitted in this manner. See Multiple Award Schedule 
48, “Transportation, Delivery and Relocation Solutions,” on the GSA eLibrary Website 
(http://www. gsaelibrary.gsa.gov/ElibMain/home.do) for a listing of commercial carriers 
authorized for use under the provisions of this paragraph. 


d. U.S. Postal Service registered mail within and between the United States, the District of 
Columbia, and the Commonwealth of Puerto Rico. 


e. U.S. Postal Service Express mail within and between the 50 States, the District of 
Columbia, and the Commonwealth of Puerto Rico. The “Waiver of Signature and Indemnity” 
block on the U.S. Postal Service Express Mail Label 11-B may not be executed under any 
circumstances. The use of external (street side) Express Mail collection boxes is prohibited. 


f. U.S. Postal Service and Canadian registered mail with registered mail receipt between 
U.S. Government and Canadian government installations in the United States and Canada. 


g. U.S. Postal Service registered mail through Military Postal Service facilities outside the 


United States and its territories, if the information does not at any time pass out of U.S. citizen 
control and does not pass through a foreign postal system or any foreign inspection. 
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h. Carriers cleared under the National Industrial Security Program providing a protective 
security service. This method is authorized only within the continental United States (CONUS) 
when other methods are impractical, except that this method is also authorized between U.S. and 
Canadian government approved locations documented in a transportation plan approved by U.S. 
and Canadian government security authorities. 


i. U.S. Government and U.S. Government contract vehicles including aircraft, ships of the 
U.S. Navy, civil service-operated U.S. Naval ships, and ships of U.S. registry. Appropriately 
cleared operators of vehicles, officers of ships or pilots of aircraft who are U.S. citizens may be 
designated as escorts provided the control of the carrier is maintained on a 24-hour basis. The 
escort shall protect the shipment at all times, through personal observation or authorized storage 
to prevent inspection, tampering, pilferage, or unauthorized access. Observing the shipment is 
not required during flight or sea transit, provided it is loaded into a compartment that is not 
accessible to any unauthorized persons or in a specialized secure, safe-like container. 


j. Air carrier without an appropriately cleared escort to locations outside the United States 
and its territories, provided the provisions of this paragraph are met. In exceptional 
circumstances, with the written approval of the sending and receiving government DSAs, 
material may be transmitted outside the United States and its territories without an appropriately 
cleared escort provided the following criteria are met: 


(1) The material is stored in the hold of an aircraft of an U.S. owned or registered air 
carrier or an air carrier owned by or under the registry of the recipient government. 


(2) The shipment is placed in a compartment that is not accessible to any unauthorized 
person or in a specialized shipping container approved for this purpose. 


(3) The air carrier agrees in writing to permit a cleared DoD or cleared U.S. company 
employee, specifically designated by name, to observe placement of the classified shipment into 
the aircraft. 


(4) The flight is direct between two designated points with no intermediate stops. 


(5) The air carrier agrees in writing that a designated officer on the aircraft will assume 
responsibility for the classified material while en route to the destination. 


(6) Written emergency instructions are provided to the air carrier. 

(7) Arrangements are made for recipient foreign government officials, the designated 
government representative (DGR), or other recipient government representative, designated by 
name and organization, in writing, to be present at the unloading of the consignment and 
immediately assume security control for the recipient government. 


(8) The foregoing requirements are documented in the transportation plan. 


(9) The exceptional circumstances are documented in the request for exception. 


Change 3, 07/28/2020 56 ENCLOSURE 4 


26 


27 


DoDM 5200.01-V3, February 24, 2012 


5. TRANSMISSION OF CONFIDENTIAL INFORMATION. Confidential information may be 
transmitted by: 


a. Any of the means approved for the transmission of Secret information. 
b. U.S. Postal Service Registered Mail for: 


(1) Material to and from military post office addressees (i.e., Fleet Post Office or Army 
Post Office) located outside the United States and its territories. 


(2) Material when the originator is uncertain that the addressee’s location is within U.S. 
boundaries. 


c. U.S. Postal Service certified mail (or registered mail, if required above) for material 
addressed to DoD contractors or non-DoD agencies. 


d. U.S. Postal Service first class mail between DoD Component locations anywhere in the 
United States and its territories. The outer envelope or wrapper shall be endorsed: “Return 
Service Requested.” 


e. Commercial carriers that provide a constant surveillance service, as defined in Reference 
(w), within CONUS. 


f. Commanders or masters of ships of U.S. registry who are U.S. citizens. Confidential 
information shipped on ships of U.S. registry may not pass out of U.S. Government control. The 
commanders or masters shall sign a receipt for the material and agree to: 


(1) Deny unauthorized persons access to the Confidential material, including customs 
inspectors, with the understanding that Confidential cargo that would be subject to customs 
inspection shall not be unloaded. 


(2) Maintain control of the cargo until a receipt is obtained from an authorized 
representative of the consignee. 


g. Alternative or additional methods of transmission the Head of the DoD Component 
approves. 


6. TRANSMISSION OF CLASSIFIED INFORMATION AND MATERIAL TO FOREIGN 
GOVERNMENTS. Classified information and material approved for release to a foreign 
government or international organization (collectively “foreign governments”) according to 
Reference (y) shall be transmitted between representatives of each government through 
government-to-government channels or through other channels agreed to in writing by the DSAs 
of the sending and receiving governments. International transfers of classified material shall 
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comply with this enclosure, its appendix, and the following: 


a. U.S. Government control and accountability of classified information or material shall be 
maintained from the point of origin to the ultimate destination, until it is officially transferred to 
the intended recipient government through its designated government representative (DGR). 


b. In urgent situations, appropriately cleared U.S. Government agency employees may be 
authorized to hand-carry classified material in accordance with this enclosure and its appendix. 


c. Each DoD Component entering into a contract or an international agreement that will 
entail the transfer of classified information and material to a foreign government shall consult 
with supporting DoD transportation and security authorities to confirm the appropriate transfer 
arrangements and establish responsibilities for the transfer arrangements prior to the execution of 
the agreement or contract. 


7. SECURITY REQUIREMENTS FOR TRANSFERS OF DEFENSE ARTICLES TO 
AUSTRALIA OR THE UNITED KINGDOM WITHOUT AN EXPORT LICENSE OR OTHER 
WRITTEN AUTHORIZATION 


a. Background. The Defense Trade Cooperation Treaty between the United States and 
Australia, which was signed by the United States on September 5, 2007, and the Defense Trade 
Cooperation Treaty between the United States and the United Kingdom (UK), which was signed 
by the United States on June 21, 2007, provide comprehensive frameworks for exports and 
transfers of certain classified and unclassified defense articles, without an export license or other 
written authorization to Australian Communities and United Kingdom Communities respectively 
(see Glossary). The provisions of the treaties apply to both government organizations and 
contractors. This section provides implementing guidance to DoD entities that are eligible to 
export certain classified and unclassified defense articles. 


b. Applicability. Defense articles (defined in Glossary) fall under the scope of the treaties 
when they are in support of: 


(1) United States and Australia or UK, as applicable, combined military or counter- 
terrorism operations; 


(2) United States and Australia or UK, as applicable, cooperative security and defense 
research, development, production, and support programs; 


(3) Mutually determined specific security and defense projects where the Government of 
Australia or Government of the United Kingdom, as applicable, is the end-user; or 


(4) U.S. Government end-use. 


c. Markings. Prior to transfer to Australia or the UK, defense articles that fall under the 
scope of these treaties must be labeled, as applicable, with an overall marking as directed in 
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subparagraph 7.c.(1) or 7.c.(2) of this enclosure. While these markings do not generally conform 
to the marking standard specified in Volume 2 of this Manual, the markings are required by these 
Defense Trade Cooperation Treaties and their Implementing Arrangements and must be used as 
specified. 

(1) Markings required for transfer of defense articles to Australia: 

(a) Classified U.S. defense articles shall be marked: 

CLASSIFICATION LEVEL USML//REL AUS AND USA TREATY COMMUNITY// 
For example, for defense articles classified SECRET, the marking shall be “SECRET 
USML//REL AUS AND USA TREATY COMMUNITY//.” Apply other applicable 
classification markings (e.g., classification authority block, portion markings, other 
dissemination markings) in accordance with Volume 2 of this Manual. 

(b) Unclassified U.S. defense articles shall be marked: 

//RESTRICTED USML//REL AUS AND USA TREATY COMMUNITY// 

(c) When defense articles are returned from Australia to the United States, any 
defense articles marked as RESTRICTED in this manner purely for the purposes of the treaty 
will be considered to be unclassified and such markings shall be removed. 

(2) Markings required for transfer of defense articles to the UK: 

(a) Classified U.S. defense articles shall be marked: 

CLASSIFICATION LEVEL USML//REL USA AND GBR TREATY COMMUNITY// 
For example, for defense articles classified SECRET, the marking shall be “SECRET 
USML//REL USA AND GBR TREATY COMMUNITY//.”, Apply other applicable 
classification markings (e.g., classification authority block, portion markings, other 
dissemination markings) in accordance with Volume 2 of this Manual. 

(b) Unclassified U.S. defense articles shall be marked: 

//RESTRICTED USML//REL USA AND GBR TREATY COMMUNITY// 

(c) When defense articles are returned from the UK to the United States, any defense 
articles marked as RESTRICTED in this manner purely for the purposes of the treaty will be 
considered to be unclassified and such marking shall be removed. 

(3) The following notice shall be included (e.g., as part of the bill of lading) whenever 


defense articles are exported in accordance with the provisions of these treaties: “These U.S. 
Munitions List commodities are authorized by the U.S. Government under the U.S.-[Australia or 
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United Kingdom, as applicable] Defense Trade Cooperation Treaty for export only to [Australia 
or United Kingdom, as applicable] for use in approved projects, programs or operations by 
members of the [Australian or United Kingdom, as applicable] Community. They may not be 
retransferred or reexported or used outside of an approved project, program, or operation, either 
in their original form or after being incorporated into other end-items, without the prior written 
approval of the U.S. Department of State.” 


(4) The items to be marked are: 


(a) Defense articles (other than technical data) shall be individually labeled with the 
appropriate marking detailed in paragraphs 7.c.(1) or 7.c.(2) of this section; or, where such 
labeling is impracticable (e.g., propellants, chemicals), shall be accompanied by documentation 
clearly associating the defense articles with the appropriate markings as detailed in paragraphs 
7.c.(1) or 7.c.(2) of this section. 


(b) Technical data (including technical papers, manuals, presentations, specifications, 
guides and reports), regardless of media or means of transmission (physical, oral, or electronic), 
shall be individually labeled with the appropriate marking detailed in paragraphs 7.c.(1) or 
7.c.(2) of this section; or, where such labeling is impracticable shall be accompanied by 
documentation or verbal notification clearly associating the technical data with the appropriate 
markings as detailed in paragraphs 7.c.(1) or 7.c.(2) of this section. 


d. Transfers 


(1) All defense articles that fall under the scope of the treaty must be transferred from the 
U.S. point of embarkation through channels approved by both the United States and, as 
appropriate, Australia or the UK. 


(2) For transfers of defense articles as freight, the contractor shall prepare a 
transportation plan in accordance with section 10 of the Appendix to Enclosure 4 of this Volume. 
For transfer of classified U.S. defense articles, a freight forwarder must have a valid facility 
security clearance and storage capability at the appropriate level. For unclassified U.S. defense 
articles that are transferred as freight, a freight forwarder is not required to be cleared. 


8. USE OF SECURE COMMUNICATIONS FOR TRANSMISSION OF CLASSIFIED 
INFORMATION. Transmission of DoD information shall comply, as appropriate, with the 
COMSEC measures and procedures identified in DoDI 8523.01 (Reference (bb)). 


a. Computer-to-Computer Transmission. In addition to meeting the requirements of 
paragraph 3.b of this enclosure, computer and other IT systems used for transmitting classified 
information shall be approved and accredited in accordance with Reference (s) or Intelligence 
Community Directive 503 (Reference (bc)), as applicable, to operate at a level of classification 
commensurate with the data being transmitted. Electronic transmission of classified information 
over secure computer-to-computer links (e.g., via secure e-mail) is preferable to physical transfer 
of hard copy documents. Classified information transmitted in this manner shall be marked in 
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accordance with Volume 2 of this Manual. 


b. Facsimile (Fax) Transmission. Only secure facsimile equipment shall be used for 
facsimile transmission of classified information. The following procedures shall be followed: 


(1) The individual transmitting the information shall ensure the recipient has the 
appropriate clearance and a need to know, and that the secure connection is at the appropriate 
level of classification for the information being transmitted. 


(2) Header or cover sheets used to precede the transmission of classified material shall 
be conspicuously marked with the highest security classification of the transmitted information 
and any required control markings. The cover sheet shall also include the originator’s name, 
organization, phone number, an unclassified title, the number of pages, and the receiver’s name, 
organization and phone number. When the cover sheet contains no classified information, it 
shall also note “Unclassified When Classified Attachment(s) Removed.” 


(3) Documents transmitted by fax shall have all markings required for a finished 
document, and shall be controlled and safeguarded by the recipient accordingly. 


c. Telephone. Only approved secure telephones, including cell phones and phones integral 
to personal electronic devices, authorized by the Director, NSA pursuant to paragraph 3.b of this 
enclosure, may used for telephonic transmission of classified information. Users must ensure the 
secure connection is at the appropriate level of classification for the information being discussed. 


9. SHIPMENT OF BULK CLASSIFIED MATERIAL AS FREIGHT. Procedures established 
for shipping bulk classified material as freight shall include provisions for shipping material in 
closed vehicles when required, appropriate notice to the consignee concerning the shipment, 
procedures at transshipment activities, and actions to be taken in the case of non-delivery or 
unexpected delay in delivery. 


10. PREPARATION OF MATERIAL FOR SHIPMENT. When transferring classified 
information, it shall be enclosed in two opaque, sealed envelopes, wrappings, or containers, 
durable enough to properly protect the material from accidental exposure and facilitate detection 
of tampering. 


a. Prepare, package, and securely seal classified material in ways that minimize risk of 
accidental exposure or undetected deliberate compromise. To minimize the risk of exposure of 
classified information, package documents so that classified material is not in direct contact with 
the inner envelope or container (e.g., fold so classified material faces together). 


(1) Address the outer envelope or container to an official U.S. Government activity or to 
a DoD contractor with a facility clearance and appropriate storage capability and show the 
complete return address of the sender. Do not address the outer envelope to an individual. 
Office codes or phrases such as “Attention: Research Department” may be used. 
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(2) Show the address of the receiving activity, the address of the sender, the highest 
classification of the contents (including, where appropriate, any special dissemination or control 
markings such as “Restricted Data” or “NATO”), and any applicable special instructions on the 
inner envelope or container. The inner envelope may have an attention line with a person’s 
name. 


(3) Do not place a classification marking or any other unusual marks on the outer 
envelope or container that might invite special attention to the fact that the contents are 
classified. 


(4) Address classified information intended only for U.S. elements of international staffs 
or other organizations specifically to those elements. 


b. When classified material is hand-carried outside an activity, a locked briefcase or zippered 
pouch may serve as the outer wrapper. In such cases, the addressing requirements of 
subparagraph 10.a.(1) of this section do not apply. Refer to section 11 of this enclosure for 
additional requirements on use of briefcases and pouches. 


c. If the classified material is an accessible internal component of an item of equipment, the 
outside shell or body may be considered as the inner enclosure provided it does not reveal 
classified information. 


d. If the classified material is an inaccessible internal component of a bulky item of 
equipment, the outside or body of the item may be considered a sufficient enclosure provided 
observation of it does not reveal classified information. 


e. If the classified material is an item of equipment that cannot be packaged and the shell or 
body is classified, it shall be concealed with an opaque covering hiding all classified features. 


f. Specialized shipping containers, including closed cargo transporters, may be considered 
the outer wrapping or cover. 


11. USE OF BRIEFCASES OR ZIPPERED POUCHES FOR HAND-CARRYING 
CLASSIFIED MATERIAL. A locked briefcase or zippered pouch made of canvas or other 
heavy-duty material and having an integral key-operated lock may be used for hand-carrying 
classified material outside an activity. Such cases may also be used to restrict access to 
classified material when the intended recipient is not immediately available. If using a briefcase 
or pouch to hand-carry classified material outside an activity, or in any circumstance when the 
possibility exists that the briefcase or pouch shall be left for subsequent opening by the intended 
recipient, package the material as required by section 10 of this enclosure and additionally 
observe the following procedures: 


a. Clearly and recognizably display the name and street address of the organization sending 
the classified material, and the name and telephone number of a point of contact within the 
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sending activity, on the outside of the briefcase or pouch. 


b. Serially number the pouch or briefcase and clearly display this serial number on its 
exterior surface. 


c. Lock the briefcase or pouch and place its key in a separate sealed envelope. 


d. Store the briefcase or pouch, when containing classified material, according to the highest 
classification level and any special controls applicable to its contents. 


e. Ensure the activity authorizing use of the briefcase or pouch maintains an internal system 
to account for and track the location of the pouch and its key. 


f. Use a briefcase or pouch only to assist in enforcing need to know. Its use shall in no way 


abrogate personal responsibility to ensure that the classified material is delivered to a person who 
has an appropriate security clearance and access for the information involved. 


12. ESCORT, COURIER, OR HAND-CARRY OF CLASSIFIED MATERIAL 


a. Authority. Appropriately cleared and briefed personnel may be authorized to escort or 
carry classified material between locations when other means of transmission or transportation 
cannot be used. The Heads of the DoD Components shall establish procedures to ensure that 
hand-carrying of classified material is minimized to the greatest extent possible and does not 
pose unacceptable risk to the information. Hand carrying may be authorized only when: 


(1) The information is not available at the destination and operational necessity or a 
contractual requirement requires it. 


(2) The information cannot be sent via a secure e-mail, facsimile transmission or other 
secure Means. 


(3) The appropriate official authorizes the hand-carry according to procedures the Head 
of the DoD Component establishes. 


(4) The hand-carry is accomplished aboard a U.S. carrier, or a foreign carrier if no U.S. 
carrier is available, and the U.S. escort retains custody and physical control of the information at 
all times. 


(5) Arrangements have been made for secure storage of the information at a U.S. 


Government or cleared U.S. contractor facility. 


b. Packaging Requirements. Classified material that is hand-carried shall be packaged in the 
same manner as described in section 10 of this enclosure for material being shipped. 
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c. Responsibilities. Individuals hand carrying or serving as couriers or escorts for classified 
information shall be informed of, and acknowledge, their security responsibilities. These 
requirements may be satisfied by a briefing or by requiring the individual to read written 
instructions that state the following responsibilities: 


(1) The individual is liable and responsible for the material being carried or escorted. 


(2) The material is not, under any circumstances, to be left unattended. During overnight 
stops arrangements shall be made for storage of the classified material at a U.S. military facility, 
embassy, or cleared contractor facility. Classified information shall not be stored in hotel safes. 


(3) The material shall not be opened en route except in the circumstances described in 
paragraph 12.d of this section. 


(4) The material shall not be discussed or disclosed in any public place. 
(5) The individual shall not deviate from the authorized travel schedule. 
(6) In cases of emergency, the individual shall take measures to protect the material. 


(7) The individual is responsible for ensuring that personal travel documents (passport, 
courier authorization (if required), medical documents, etc.) are complete, valid, and current. 


d. Customs, Police, and Immigration. Arrangements shall be made in advance with customs, 
police and/or immigration officials to facilitate movement through security. However, there is 
no assurance of immunity from search by the customs, police, and/or immigration officials of 
countries, including the United States, whose border the courier may cross. Therefore, if such 
officials inquire into the contents of the consignment, the courier shall present the courier 
authorization or orders and ask to speak to the senior customs, police, and/or immigration 
official. This action shall normally suffice to pass the material through unopened. However, if 
the senior official demands to see the actual contents of the package, it may be opened in his or 
her presence, but shall be done in an area out of sight of the public. In that instance: 


(1) Precautions shall be taken to show officials only as much of the contents as satisfies 
them that the package does not contain any other item. The courier shall ask the official to 
repack the material or assist in repacking it immediately upon completing the examination. 


(2) The senior customs, police, or immigration official shall be requested to provide 
evidence of opening and inspection of the package by sealing and signing it when closed and 
confirming on the shipping documents (if any) or courier certificate that the package has been 
opened. Both the addressee and the dispatching security officer shall be informed in writing of 
the opening of the material. 


(3) Classified material to be carried by a courier shall be inventoried, a copy of the 
inventory shall be retained at the courier’s office or duty location, and the courier shall carry a 


copy. 
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(4) Upon return, the courier shall return all classified material in a sealed package or, for 
any classified material that is not returned, produce a receipt signed by the security officer of the 
addressee organization. 


(5) For guidance on hand-carrying NATO classified material, see Reference (ab). 


e. Disclosure Authorization. In the event that the hand-carry of classified information shall 
also involve the disclosure of such information to foreign nationals, the DoD Component official 
responsible for approving the hand-carry is also responsible for ensuring a disclosure 
authorization is obtained in accordance with Reference (y). 


13. ESCORT, COURIER, OR HAND-CARRY AUTHORIZATION. Responsible officials, as 
determined by DoD Component procedures, shall provide a written statement to each individual 
who is authorized to escort, courier, or hand-carry classified material. Procedures for authorizing 
on-site contractors to escort, courier, or hand-carry classified material shall comply with the 
requirements of References (w) and (az). Authorization to escort, courier, or hand-carry SCI 
shall be in accordance with Reference (i). 


a. The authorization statement may be contained in a letter, a courier card, or other written 
document, including travel orders. For travel aboard commercial aircraft, section 14 of this 
enclosure also applies. For international travel, also see the Appendix to this enclosure. 


b. DoD (DD) Form 2501, “Courier Authorization,” may be used to identify appropriately 
cleared DoD military and civilian personnel who have been approved to hand-carry classified 
material according to the following: 


(1) The individual has a recurrent need to hand-carry classified information. 

(2) An appropriate official in the individual’s servicing security office signs the form. 

(3) The form is issued for no more than 2 years at a time. The requirement for 
authorization to hand-carry classified information shall be reevaluated and/or revalidated at least 


once every 2 years, and a new form issued, if appropriate. 


(4) Only the last four (4) digits of the individual’s social security number shall be used in 
completing the DD Form 2501. Currently valid DD Forms 2501 shall be updated when renewed. 


(5) The use of the DD Form 2501 for verification of authorization to hand-carry SCI or 
SAP information shall be according to policies and procedures established by the official having 
security responsibility for such information or programs. 


14. HAND-CARRYING OR ESCORTING CLASSIFIED INFORMATION ON 
COMMERCIAL AIRCRAFT. Although pre-coordination is not typically required, in unusual 
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situations advance coordination with the local Transportation Security Administration (TSA) 
field office may be warranted to facilitate clearance through airline screening processes. 


a. The individual designated as courier shall possess a DoD or contractor-issued 
identification card and a government-issued photo identification card. (If at least one of the 
identification cards does not contain date of birth, height, weight, and signature, include these 
items in the written authorization.) 


b. The courier shall have a courier card or authorization letter prepared on letterhead 
stationary of the agency authorizing the carrying of classified material, which shall: 


(1) Give the full name of the individual and his or her employing agency or company. 
(2) Carry a date of issue and an expiration date. 
(3) Carry the name, title, signature, and phone number of the official issuing the letter. 


(4) Carry the name of the person and official U.S. Government telephone number of the 
person designated to confirm the courier authorization. 


c. Upon arrival at the screening checkpoint the individual designated as courier shall ask to 
speak to the TSA Supervisory Transportation Security Officer and shall present the required 
identification and authorization documents. If the courier does not present all required 
documents, including valid courier authorization, DoD or contractor-issued identification card, 
and government-issued photo identification card, TSA officials will require the classified 
material to be screened in accordance with their standard procedures. 


d. The courier shall go through the same airline ticketing and boarding process as other 
passengers. When the TSA Supervisory Transportation Security Officer confirms the courier’s 
authorization to carry classified material, only the U.S. Government classified material is 
exempted from any form of inspection; the courier and all of the courier’s personal property shall 
be provided for screening. The classified material shall remain within the courier’s sight at all 
times during the screening process. When requested, the package(s) or the carry-on luggage 
containing the classified information may be presented for security screening so long as the 
courier maintains visual sight and the packaging or luggage is not opened. 


e. Hand-carrying items aboard international commercial aircraft shall be done only on an 
exception basis. DoD travelers requiring access to classified materials at an overseas location 
shall exhaust all other transmission options (e.g., electronic file transfer, advance shipment by 
courier) before hand-carrying items aboard international commercial aircraft. See also sections 
12 and 13, paying particular attention to paragraph 12.d. In addition to the requirements in the 
subparagraphs above, for international travel the authorization letter shall describe the material 
being carried (e.g., “three sealed packages (9” x 8” x 24”),” addressee and sender) and the 
official who signed the authorization letter shall sign each package or carton to be exempt to 
facilitate its identification. 
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Appendix 
Transfer of Classified Information or Material to Foreign Governments 
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APPENDIX TO ENCLOSURE 4 


TRANSFER OF CLASSIFIED INFORMATION OR MATERIAL TO FOREIGN 
GOVERNMENTS 


1. GENERAL 


a. Transfers of classified information and material to a foreign government or international 
organization (hereinafter, “foreign government”) may occur in the United States, in the recipient 
country, or in a third country. The risks of loss or compromise increase when classified 
information and material are transferred across international borders. Therefore, transfer 
arrangements must be thorough and clearly written. They must be understood and agreed to by 
the sending and receiving government officials involved in the transfer. 


b. Transfers shall occur between government officials through official government-to- 
government channels (e.g., U.S. Government military transportation, Military Postal Service 
registered mail, Defense Courier Service, the Defense Transportation System). However, in 
some cases, it may not be possible to transfer the information and material through official 
government-to-government channels; the use of other channels may be necessary. These other 
channels may involve transfers by hand carrying or secure communications between cleared 
contractors or the use of cleared freight forwarders and commercial carriers. 


c. Classified information or material, approved for disclosure in accordance with Reference 
(y), to be transferred to a foreign government or its representative shall be transferred only to a 
person or organization designated by the recipient government to sign for and assume custody 
and responsibility on behalf of the government. This designation should be in a letter of offer 
and acceptance (LOA), in a program agreement or arrangement or its implementing procedures, 
in a contract, or in a visit authorization. The designation shall contain assurances that the person 
to receive the information or material will have a security clearance at the appropriate level, that 
the person shall assume full security responsibility for the material on behalf of the foreign 
government, and that the information will be protected in accordance with the governing 
agreement or arrangement. 


d. If other than government-to-government channels are to be used to transfer classified 
information or material to a foreign government, written transfer arrangements shall be approved 
by the DSAs of the sending and receiving governments, unless authority is delegated by a DSA, 
in writing, to a DGR of the respective sending or receiving government. The written 
arrangements shall provide for a DoD DGR or other DoD official to exercise oversight and 
ensure secure transfer from the point of origin to the ultimate destination, or to another agreed 
location where the recipient government’s representative assumes responsibility. The 
information or material transferred shall be classified no higher than Secret. 


e. Each LOA, agreement, contract, or other arrangement involving the disclosure or release 


of classified information or material to foreign governments shall either contain detailed transfer 
instructions or require that the DoD Component sponsoring the transaction and the recipient 
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government prepare and approve a separate plan for transferring the information or material. See 
section 10 of this appendix for required transportation plan content. If classified information or 
material is to be transferred from a non-governmental entity to a foreign government, it is also 
subject to the requirement of Reference (x). 


f. U.S. Government communications and IT systems used for the transfer of classified 
information to foreign governments shall comply with paragraph 8.a. of Enclosure 4 of this 
Volume. 


g. The requirements of this appendix do not pertain to: 


(1) The disclosure or release of intelligence information and products under the purview 
of the DNI. Such disclosure or release shall be governed by policy issued by the DNI. 


(2) Transfers of classified information and material during visits, which shall comply 
with Reference (q) and paragraph C3.2.7.6 of the Department of Defense Foreign Clearance 
Manual (Reference (bd)). 


2. RECEIPTS. Receipts are required for all transfers of classified information and material to a 
foreign government, except as noted in paragraphs 2.a. and 2.b. of this section. The receipts 
serve two important purposes. First, they document the transfer of security jurisdiction between 
the governments. Second, they alert the recipient government that the information or material 
has been transferred, and that it is responsible for protecting the information or material in 
compliance with the pertinent security or program agreement or arrangement. 


a. Most foreign governments waive the receipt requirement for their restricted information. 


b. Transmissions of classified information to a foreign government by IT and 
communications systems meeting the requirements of paragraph 1.f. of this appendix shall, at a 
minimum, be audited to assure that the intended recipient receives the information. The audit 
procedures for verifying receipt shall be commensurate with those specified in Reference (v). 


3. TRANSFERS BY DOD COMPONENT COURIER SERVICE, HAND-CARRYING, OR 
POSTAL SERVICE. Classified material that is of such size, weight, and configuration that it is 
suitable for transfer by an official DoD Component courier service, by a DoD employee 
approved to hand-carry classified information or material, or by U.S. Postal Service or Military 
Postal Service registered mail, shall be transferred in compliance with Enclosure 4 of this 
volume, and shall be delivered or addressed to: 


a. An embassy, consulate, or other official agency of the recipient government having 
extraterritorial status in the United States; or 


b. A U.S. Embassy or a U.S. military organization in the recipient country or in a third-party 
country for delivery to a DGR or other designated representative of the recipient government. 
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4. TRANSFERS OF CLASSIFIED INFORMATION OR MATERIAL AS FREIGHT 


a. Foreign Military Sales (FMS). DoD officials authorized to approve an FMS transaction 
involving the delivery of U.S. classified material to a foreign government shall, prior to any 
commitment on transfer arrangements, consult with supporting transportation officials to 
determine if secure U.S. Government transportation is available through U.S. Transportation 
Command or other DoD transportation authorities (e.g., Surface Deployment and Distribution 
Command, Military Sealift Command, Air Mobility Command) from the CONUS point of origin 
to the ultimate foreign destination, and to facilitate other modes of transfer when U.S. 
Government transportation is not available. Normally, the United States shall use the Defense 
Transportation System to deliver classified material resulting from FMS to the recipient 
government. The DoD Component FMS implementing agency that prepares the LOA shall 
develop a transportation plan in coordination with the foreign government. A generic 
transportation plan, containing standard security requirements necessary for any transfer, should 
be prepared during LOA negotiation. The LOA should specify responsibilities for completing 
the plan prior to the transfer of material. Security and transportation officials supporting the 
implementing agency shall evaluate and approve the transportation plan, in accordance with 
requirements of DoDD 5105.65 (Reference (be)). If the plan is not satisfactory, the 
implementing agency will require that transfers be delayed until the plan is satisfactory. 


b. Direct Commercial Sales. In accordance with Reference (w), transfers of classified 
material resulting from direct commercial sales shall comply with the same security standards 
that apply to FMS transfers, including the preparation of a generic transportation plan during 
contract negotiations. 


c. Cooperative Programs. Transfer of classified information or material in support of a 
cooperative program shall be through official government-to-government channels or through 
other channels as agreed to by the respective governments (government-to-government transfer). 


5. DELIVERY WITHIN THE UNITED STATES. Delivery of classified information or 
material to a foreign government at a point within the United States, using carriers specified in 
Enclosure 4 for the level of classified information or material involved, shall take place at: 


a. An embassy, consulate, or other official agency under the control of the recipient 
government. An official designated by the foreign government as its DGR shall sign for the 
consignment. 


b. The point of origin. When a DGR or other representative designated by the recipient 
government accepts delivery of classified material at the point of origin (e.g., a manufacturing 
facility or depot), the DoD DGR or other designated DoD official who transfers custody shall 
ensure that the recipient has a copy of the transportation plan and understands the secure means 
of onward movement of the classified material to its final destination, consistent with the 
approved transportation plan. A freight forwarder or other transportation agent shall not be 
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designated as a DGR. Such entities merely facilitate the shipment of the material and are subject 
to U.S. jurisdiction. 


c. A military or commercial port of embarkation (POE) that is a recognized point of 
departure from the United States for on-loading aboard a ship, aircraft, or other carrier which is 
owned, controlled by, or registered to the recipient government. In such case, the transportation 
plan shall provide for U.S.-controlled shipment to the U.S. transshipment point and the 
identification of a cleared storage facility, U.S. Government or commercial, at or near the POE. 
The transportation plan shall identify the person who is to assume security oversight and control 
of the material while it is aboard the carrier. A DoD DGR or other designated U.S. Government 
official authorized to transfer custody shall supervise or observe the on loading of the classified 
material being transferred unless physical custody and security responsibility for the material is 
assumed by the recipient government’s DGR prior to loading. In the event that transfer of 
physical and security custody cannot be accomplished promptly, the DoD official shall ensure 
that the classified material is either returned to a secure storage facility of the U.S. shipper, 
segregated and placed under constant surveillance of a duly cleared U.S. security force at the 
POE, or held in a secure storage facility designated in the transportation plan. 


d. A cleared freight forwarder facility identified by the recipient government in the 
transportation plan as its transfer agent. Unless the recipient government DGR is present to 
accept delivery of the classified material and receipt for it, to include acceptance of security 
responsibility on behalf of the recipient government, the DoD DGR shall maintain oversight until 
the recipient government DGR signs for and accepts such responsibility. The freight forwarder 
is a transfer agent and shall not be the recipient government’s DGR. 


6. DELIVERY OUTSIDE THE UNITED STATES 


a. Within the Recipient Country. Classified material to be delivered to a foreign government 
within the recipient country shall be delivered on arrival in the recipient country to a U.S. 
Government representative who shall arrange for its transfer to a DGR or other recipient 
government representative identified in the transportation plan. If a U.S. Government official 
authorized to accomplish the transfer of custody escorts the shipment, the material may be 
delivered directly to the recipient government’s DGR or other recipient government 
representative upon arrival. 


b. Ina Third Country. Classified material to be delivered to a foreign government 
representative within a third country shall be delivered to an agency or installation of the United 
States, or of the recipient government, that has extraterritorial status or otherwise is exempt from 
the jurisdiction of the third country. Unless a U.S. Government official authorized to accomplish 
the transfer of custody escorts the material, a U.S. Government official shall be designated 
locally to receive the shipment upon arrival and deliver it to a DGR or other recipient 
government representative identified in the transportation plan. 
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7. USE OF INTERNATIONAL CARRIERS. Transfers of classified material to locations 
outside the United States shall be made only via ships, aircraft, or other carriers as specified in 
Enclosure 4 of this Volume. 


8. ESCORTS. Escorts are required aboard the carrier when transfers to a foreign government 
are to occur outside the United States. Escorts shall possess personnel security clearances of at 
least the same classification level as the material to be transferred. The escorts shall be provided 
by the implementing agency for FMS cases or by the U.S. cleared contractor for direct 
commercial sales, unless: 


a. The material is shipped by U.S. military carrier and the crew assumes control of the 
material. 


b. The recipient government DGR has signed for the consignment, a recipient-government 
military carrier or carrier owned by or registered to the recipient government is used, and the 
recipient government provides the cleared escort. 


c. The exception authorized in paragraph 4.j. of Enclosure 4 is used and the conditions of 
that paragraph are met. 


9. RETURN FOR REPAIR, MODIFICATION, OR MAINTENANCE. Foreign governments 
may return classified material for repair, modification, or maintenance. The requirements for 
return shipment shall be specified in the LOA for FMS and in the security requirements section 
of a direct commercial sales contract. The transfer procedures shall be in the original 
transportation plan and shall include the same details on transportation channels, routes, transfer 
points, and identity of responsible officials as specified for the original transfer. 


10. TRANSPORTATION PLAN. The transportation plan required by paragraph 1.e. of this 
appendix shall, at a minimum, include: 


a. The purpose of the plan (i.e., FMS or direct commercial sale, with FMS case designator or 
commercial contract identification), purchasing government, and date. 


b. A description of the material to be shipped, identification of the associated FMS case or 
contract line item(s), munitions list category, and classification. 


c. A description of packaging requirements, seals, and storage requirements during 
shipment. 


d. Identification, by name, title, organization of the DGRs, security and transportation 
officials who will arrange the transfer of, sign receipts for, and assume security responsibility for 
the freight during the transfer process. Mailing addresses, telephone numbers, fax numbers, and 
e-mail addresses must be listed for each government’s representatives. 
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e. Identification and specific location(s) of the delivery points, transfer points, and/or 
processing points and description of the security arrangements for the material while located at 
each point; if transfers will occur between carriers, explain the process, including the 
identification of persons who will be involved. 


f. Identification of commercial entities that will be involved in the shipping process (e.g., 
carriers and freight forwarders or transportation agents), the extent of their involvement, and 
their clearance. Include names, addresses, telephone and fax numbers, e-mail addresses, and 
points of contact. 


g. A description of each segment of the route to be taken and, if applicable, security 
arrangements for overnight stops or delays. 


h. Arrangements for dealing with port and carrier security, immigration, and customs 
officials. Identify personnel from each who have been consulted (and an alternate), and their 
telephone and fax numbers, and e-mail addresses. 


i. Names of escorts (and who they represent) or other responsible officials (e.g., Captain or 
crew chief) to be used, including their government identification, passport numbers, security 
clearances, and details concerning their responsibilities. Describe procedures for their 
accessibility to the material while in storage. If the shipment will occur on a recurring basis, the 
shipper shall provide an updated list of escorts with their identifying data prior to each shipment 
in accordance with provisions of the approved plan. 


j. A description of emergency procedures, and who is responsible for actions that must be 
taken in the event of an emergency (e.g., unexpected stop anywhere along the route). Identify 
individuals by name, and provide their organization, telephone and fax numbers, and e-mail 
addresses. 


k. Procedures for loading and securing the material. 


l. Procedures for unloading the material and dealing with government port security, 
customs, and immigration officials. 


m. Identification, by name and personal identification, of the person who will ultimately sign 
for and assume final control of the material for the recipient government. 


n. A requirement for the recipient government to examine shipping documents upon 
receiving classified material in its own territory and notify the DoD Component responsible for 
security of the classified material if the material has been transferred en route to any carrier not 
authorized by the transportation plan. 


o. A requirement for the recipient government to inform the DoD Component responsible 


for the security of the classified material promptly and fully of any known or suspected 
compromise of the classified material. 
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p. Specific, detailed arrangements for return shipments for repair, overhaul, modification, or 
maintenance (see section 9 of this appendix). 
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ENCLOSURE 5 


SECURITY EDUCATION AND TRAINING 


1. REQUIREMENT, The Heads of the DoD Components shall ensure that their personnel 
receive security education and training that: 


a. Provides necessary knowledge and information to enable quality performance of security 
functions. 


b. Promotes understanding of DoD Information Security Program policies and requirements 
and their importance to national security and national interests. 


c. Instills and maintains continuing awareness of security requirements. 


d. Assists in promoting a high degree of motivation to support program goals. 


2. SECURITY EDUCATION AND TRAINING RESOURCES 


a. Security education and training may be accomplished by establishing programs within the 
DoD Component, using external resources such as the Defense Security Service Academy, or a 
combination of the two. 


b. DoD Components may, if desired, combine into one overall program the education and 
training requirements of this enclosure and those for CUI specified in Volume 4 of this Manual. 


3. INITIAL ORIENTATION. All personnel in the organization, including DoD civilians, 
military members, and on-site support contractors shall receive an initial orientation to the DoD 
Information Security Program. 


a. This initial orientation is intended to: 


(1) Define classified information and CUI and explain the importance of protecting such 
information. 


(2) Produce a basic understanding of security policies and principles. 


(3) Notify personnel of their responsibilities within the security program, and inform 
them of the administrative, civil, and/or criminal sanctions that can be applied when appropriate. 


(4) Provide individuals enough information to ensure the proper protection of classified 


information and CUI in their possession, including actions to be taken if such information is 
discovered unsecured, a security vulnerability is noted, or a person has been seeking 
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unauthorized access to such information. 


(5) Inform personnel of the need for review of ALL unclassified DoD information prior 
to its release to the public. 


b. Security educators shall also consider including in the initial orientation identification of 
the DoD Component senior agency official and activity security management personnel, a 
description of their responsibilities, and whether they are involved in the protection of classified 
or controlled unclassified information. If not included in the initial orientation, such information 
must be included in the training required by paragraph 3.c. of this section. 


c. In addition to the requirements in paragraphs 3.a. and 3.b. of this section, upon initial 
access to classified information, all personnel shall receive training on security policies and 


principles and derivative classification practices, including: 


(1) The definition of classified information, the levels of classified information, and the 
damage criteria associated with each level. 


(2) The responsibilities of DoD personnel who create or handle classified information, 
including: 


(a) The requirements for controlling access to classified information, including: 
1. The general conditions for and restrictions on access to classified information. 
2. The steps an individual shall take when he or she is asked to verify classified 
information disclosed through unofficial open sources (e.g., news media, periodicals, and public 
websites). 


(b) The policies and procedures for safeguarding classified information, including: 


1. The proper methods and procedures for using, storing, reproducing, 
transmitting, disseminating, and destroying classified information. 


2. The steps an individual shall take to safeguard classified information during an 
emergency evacuation situation. 


3. The steps an individual shall take when he or she believes classified 
information has not been, or is not being, properly protected. 


(c) The accountability of derivative classifiers for the accuracy of their work. 
(3) An explanation that derivative classification is extracting, paraphrasing, or restating 


classified information based on a security classification guide, one or more source documents, or 
both. 
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(4) The authorized types of sources that can be used for derivative classification and 
where to obtain them, including: 


(a) An explanation that a security classification guide: 
1. Is precise, comprehensive guidance regarding specific program, system, 


operation or weapon system elements of information to be classified, including classification 
levels, reasons for classification, and the duration of classification. 


IN 


. Is approved and signed by the cognizant OCA. 


JOO 


. Is an authoritative source for derivative classification. 


PS 


. Ensures consistent application of classification to the same information. 
(b) How to use a security classification guide or other derivative source. 


(c) How and where to obtain classification guidance currently available for a specific 
area of expertise, including: 


1. The security manager and/or the program or project office. 


IN 


. The Defense Technical Information Center, at www.dtic.mil (registration 
required). 


3. In the case of a military operation and the creation or execution of plans and 
orders thereto, the higher headquarters office that mandated or directed the operation or mission. 


(5) The proper and complete classification markings to be used for classified 
information, and how those markings are to be applied, including: 


(a) The importance of properly applying the authorized classification markings and 
the need to avoid over-classification. 


(b) How to document the level of classification, duration of classification and the 
source(s) of classified information included in the material (e.g., document, e-mail, briefing, 
video) being created or generated. 

(c) How to observe and respect the original classification decision(s). 

(d) How to maintain lists of sources when multiple sources of classification are used. 


(e) How to determine the duration of classification. 


(f) How to properly use control markings to limit or expand distribution, including 
foreign disclosure and release markings (e.g., “REL TO” (releasable to), “NOFORN” (not 
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releasable to foreign nationals) and DISPLAY ONLY). 
(g) How to challenge classification decisions. 


(h) How to downgrade or declassify information as an authorized holder of 
information in accordance with the direction of the cognizant OCA or classification guide. 


(i) How to mark and share “working papers” and other drafts, including the 
requirements for such markings. 


(6) The definition of a security incident, a violation and a compromise of classified 
information, examples of each, and an explanation of the criminal, civil, and administrative 
sanctions that may be taken against an individual who fails to comply with program requirements 
or to protect classified information from unauthorized disclosure. 


(7) The policies and procedures for sharing classified information with state, local, tribal, 
and private sector officials and with foreign governments and international organizations, 
including the markings that designate information as qualifying for sharing, if appropriate for the 
activity’s mission or function. 


(8) The policies and procedures for the marking, safeguarding, and accounting of NATO 
classified information. 


d. In addition to the training specified by paragraphs 3.a through 3.c of this section and 
information assurance (IA) training required by DoDD 8140.01 (Reference (bf)), personnel who 
are authorized access to classified information systems shall receive training which specifically 
addresses: 


(1) Proper use of information systems for creating, using, storing, processing, or 
transmitting classified information. 


(2) The requirement for and application of markings, including portion markings, to 
information in electronic formats (e.g., documents, e-mail, briefings, web-based information, 


databases, spreadsheets). 


(3) Marking, handling, storage, transportation, and destruction of classified computer 
media (e.g., floppy disks, CDs, DVDs, removable hard drives). 


(4) Procedures to be followed when using classified removable data storage media. 


(5) Procedures to be followed if an individual believes an unauthorized disclosure of 
classified data has occurred on an information system or network (typically called a “data spill”). 


4. SPECIAL TRAINING REQUIREMENTS 
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a. Individuals with specified duties in the Information Security Program, as identified in 
sections 5, 6, and 10 of this enclosure, shall be provided security education and training 
commensurate with job responsibilities and sufficient to permit effective performance of those 
duties. The education and training may be provided before, concurrent with, or not later than 6 
months following assuming those duties, unless otherwise specified. 


b. Deployable organizations shall provide, prior to deployment, enhanced security training to 
meet the needs of the operational environment. Where appropriate, this pre-deployment training 
shall specifically address security requirements associated with information sharing (e.g., release 
of information to state, local, tribal, or coalition partners; use and handling of FGI) and shall 
provide training on the classification markings that are to be applied in these situations and that 
designate information as qualifying for sharing. 


c. Additional security education and training may be required for personnel who: 


(1) Travel to foreign countries where special concerns about possible exploitation exist 
or attend professional meetings or conferences where foreign attendance is likely. 


(2) Escort, hand-carry, or serve as a courier for classified material. 


(3) Are authorized access to classified information requiring special control or 
safeguarding measures. 


(4) Are involved with international programs. 
(5) Are involved with acquisition programs subject to Reference (ae). 


(6) Are involved with FGI, or work in coalition or bilateral environments, or in offices, 
activities, or organizations hosting foreign exchange officers. 


(7) Submit information to OCAs for original classification decisions and therefore need 
additional knowledge of the original classification decision process. 


5. OCA TRAINING. Training for newly appointed OCAs shall be provided prior to exercise of 
the authority and each OCA shall receive training annually thereafter as required in paragraph 
7.b. of this enclosure. The OCA shall certify in writing that the training has been received. 
Personnel preparing recommendations for original classification to OCAs will receive the same 
training. The training shall address OCA responsibilities and classification principles, proper 
safeguarding of classified information, and the criminal, civil, and administrative sanctions that 
may be brought against an individual. At a minimum, the training shall address: 


a. General requirements, including: 


(1) The difference between original and derivative classification. 
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(2) Persons who can classify information originally. 


(a) OCA is assigned to a position, not a person and, except as authorized by 
Enclosure 4 of Volume 1 of this Manual, may not be further delegated. 


(b) Only individuals carrying out a unique mission with responsibility in one of the 
subject areas prescribed by section 1.4 of Reference (d) may be designated an OCA. 


(c) Deputies, vice commanders, chiefs of staff, and similar immediate subordinates 
of an OCA are empowered to exercise OCA when they have been officially designated to 
assume the duty position of the OCA in an acting capacity during the OCA’s absence and have 
certified in writing that they have received required OCA training. 


(3) The requirement to certify, in writing, before initially exercising OCA authority and 
annually thereafter, that training has been received. 


(4) The prohibitions and limitations on classifying information, as stated in sections 1 
and 2 of Enclosure 4 of Volume 1 of this Manual, and the need to avoid over classification. 


b. The responsibility and discretion the OCA has in classifying information. 

(1) OCAs must be aware that their decisions to classify information have a substantial 
impact on the operations of the Department and on national security. Others who work with the 
information use these original decisions to make proper derivative classification decisions and to 
assure that the information is properly protected from unauthorized disclosure. 

(2) OCAs are accountable to the Secretary of Defense for their classification decisions. 

(3) OCAs shall exercise a substantial degree of autonomy in operations or mission. 
Information warranting original classification must be developed in the normal course of actions 


or activity. 


c. The classification principles and process specified in section 6, Enclosure 4 of Volume 1 
of this Manual. 


(1) Original classification requires identification of specific elements of information 
which could adversely affect the national security if compromised. In addition to consideration 
of harm to the national security, OCAs must weigh the advantages and disadvantages of 
classifying each element and should consider, when applicable: 

(a) Degree of intended or anticipated dissemination or use. 


(b) Net national advantage. 


(c) Lead time advantage for operational or technological use. 
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(d) Cost in terms of time, money, and personnel. 

(e) Impact on attaining the program objective. 

(£) State of the art and public knowledge of the U.S. interest. 

(g) Appearance in the public domain, inadvertent disclosure or other compromise. 
(b) Basic scientific research data or unusually significant scientific findings. 

(i) Association or compilation of information or data. 


(2) Information is classified either because its unauthorized disclosure could reasonably 
be expected to cause identifiable or discernable damage to national security or because it may 
reveal such information when associated with other information. If information is classified in 
compilation with other information, a clear explanation of rationale must be provided (see 
section 12 of Enclosure 3 of Volume 2). 


(3) OCAs shall ensure that a review for possible declassification is conducted 
expeditiously in the event of compromise, that damage assessments are conducted as necessary, 
and that formal challenges to classification, classification conflicts, and requests for 
classification determinations from individuals who are not OCAs are addressed as required by 
this Manual. 


d. The procedures that must be followed when making and communicating original 
classification decisions. 


(1) The required markings that must appear on classified information as specified in 
Volume 2, Enclosure 3 of this Manual. 


(2) The process for determining duration of classification. 


(a) Information shall be assigned a date or event for declassification that is 25 years 
or less from the date of origination, except for information that is clearly and demonstrably 
expected to reveal the identity of a confidential human source or a human intelligence source or 
key design concepts of weapons of mass destruction. 


(b) Information in records with permanent historic value may be classified for longer 
than 25 years only if the Interagency Security Classification Appeals Panel (ISCAP) has been 
notified of such a date in accordance with the procedures in section 13, Enclosure 5 of Volume 1 
of this Manual. The ISCAP decisions will be codified in a classification or declassification 
guide. 


(3) The general standards and procedures for changes in classification (downgrade, 


upgrade, declassify) and the general requirements for automatic and systematic declassification 
and mandatory reviews for declassification. 
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(a) An OCA should organize the classification process around time and event-phased 
downgrading and declassification events to the maximum extent possible. 


(b) An OCA may change the level of classification of information under their 
jurisdiction (downgrade, upgrade, declassify) as specified in section 7, Enclosure 4 of Volume 1 
of this Manual. 


(c) Classification may change at each phase of an operation, research and 
development cycle, or acquisition, as determined by the OCA with responsibility over the 
information. 

(4) The requirements and standards for creating, issuing, and maintaining security 
classification guidance, including classification and declassification guides, as identified in 


section 8, Enclosure 4 of Volume 1 of this Manual. 


e. The proper safeguarding protections to apply when using, storing, reproducing, 
transmitting, disseminating, and destroying classified information. 


f. The criminal, civil, and administrative sanctions that may be brought against an individual 


who fails to classify information properly or to protect classified information from unauthorized 
disclosure. 


6. DECLASSIFICATION AUTHORITY TRAINING. The security education and training 
provided declassification authorities other than original classifiers shall, at a minimum, address: 


a. The standards, methods, and procedures for declassifying information pursuant to 
References (d) and (f) and this Manual. 


b. The standards for creating, maintaining, and using declassification guides. 
c. The information contained in the DoD Component’s declassification plan. 


d. The DoD Component’s responsibilities for establishing and maintaining a declassification 
database. 


e. The referral process and requirements. 


7. ANNUAL REFRESHER TRAINING 


a. Ata minimum, all DoD civilians, military members, and on-site support contractors with 
access to classified information shall receive annual refresher training that reinforces the 
policies, principle, and procedures covered in their initial and specialized training. Refresher 
training shall also address the threat and the techniques foreign intelligence activities use while 
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attempting to obtain classified DoD information, and advise personnel of penalties for engaging 
in espionage activities and other unauthorized disclosures. Refresher training shall also address 
relevant changes in information security policy or procedures and issues or concerns identified 
during DoD Component self-inspections. Information system users shall additionally complete 
an annual IA awareness refresher, as required by Reference (bf). 


b. Each OCA shall receive annual training as specified in section 5 of this enclosure. The 
OCA shall certify receipt of the training in writing. OCAs who do not receive the specified 
training at least once within a calendar year shall have their classification authority suspended by 
the DoD Component Head or the senior agency official who delegated the authority until the 
training has taken place, unless a waiver is granted in accordance with paragraph 7.f of this 
section. 


c. Derivative classifiers (i.e., those who create new documents, including e-mails, based on 
existing classification guidance) shall receive training in derivative classification as required by 
paragraph 3.c. of this enclosure, with an emphasis on avoiding over-classification, at least once 
every 2 years. Training may, at the DoD Component’s discretion, be included in the training 
required by paragraph 7.a. of this section. Derivative classifiers who do not receive training at 
least once every 2 years shall not be authorized or allowed to derivatively classify information 
until they have received training, unless a waiver is granted in accordance with paragraph 7.f of 
this section. 


d. Declassification authorities shall receive training as required by section 6 of this enclosure 
at least once every 2 years. 


e. DoD Components shall track training required by paragraphs 7.b and 7.c of this section 
and take appropriate action to suspend OCA authority in accordance with paragraph 7.b or 
disallow derivative classification in accordance with paragraph 7.c if the training is not 
accomplished as required. 


f. A waiver to the training requirement in paragraphs 7.b or 7.c of this section may be 
granted by the DoD Component Head, the Deputy Component Head, or senior agency official if 
an individual is unable to receive required training due to unavoidable circumstances. Whenever 
a waiver is granted, the individual shall receive the required training as soon as practicable. 


8. CONTINUING SECURITY EDUCATION AND TRAINING. Security education and 
training shall be continuous, rather than aperiodic. Periodic briefings, training sessions, and 
other formal presentations shall be supplemented with other information and promotional efforts 
to ensure that continuous awareness and performance quality is maintained. The use of job 
performance aids and other substitutes for formal training is encouraged when they are 
determined to be the most effective means of achieving program goals. The circulation of 
directives or similar material on a read-and-initial basis shall not be considered as the sole means 
of fulfilling any of the specific requirements of this enclosure. 
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9. TERMINATION BRIEFINGS. The DoD Components shall establish procedures to ensure 
that cleared employees who leave the organization or whose clearance is terminated receive a 
termination briefing in accordance with paragraph C9.2.5 of Reference (1). The briefing shall: 


a. Emphasize their continued responsibility to protect classified and controlled unclassified 
information to which they have had access. 


b. Provide instructions for reporting any unauthorized attempt to gain access to such 
information. 


c. Advise the individuals of the prohibitions against retaining classified and controlled 
unclassified material when leaving the organization. 


d. Identify the requirement that retired personnel, former DoD employees, and non-active 
duty members of the Reserve Components must submit writings and other materials intended for 
public release to the DoD security review process as specified by Reference (k). 


e. Remind them of the potential civil and criminal penalties for failure to fulfill their 
continuing security responsibilities. 


10. MANAGEMENT AND OVERSIGHT TRAINING. Individuals designated as security 
managers, classification management officers, security specialists, or any other personnel whose 
duties significantly involve managing and overseeing classified information shall receive training 
that meets the requirements of DoDI 3305.13 (Reference (bg)) and addresses: 


a. The original and derivative classification processes and the standards applicable to each. 
b. The proper and complete classification markings to be applied to classified information, 


c. The proper use of control markings to limit or expand distribution, including foreign 
disclosure and release markings (e.g., REL TO, NOFORN, and DISPLAY ONLY). 


d. The authorities, methods, and processes for downgrading and declassifying information. 


e. The methods for properly using, storing, reproducing, transmitting, disseminating, and 
destroying classified information. 


f. The requirements for creating, maintaining, and issuing classification and declassification 
guides. 


g. The requirements for controlling access to classified information. 
h. The procedures for investigating and reporting instances of actual or potential 


compromise of classified information, including when in electronic form, and the penalties that 
may be associated with violating established security policies and procedures. 
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i. The requirements for creating, maintaining, and terminating SAPs, and the mechanisms 
for monitoring such programs. 


j. The procedures for the secure use of information systems and networks that use, process, 
store, reproduce, or transmit classified information, and requirements for their certification and 
accreditation. 


k. The provisions for automatic declassification and the need for systematic and mandatory 
reviews for declassification, and the DoD Component procedures for accomplishing each. 


l. The requirements for overseeing the Information Security Program, including self- 
inspections. 


11. PROGRAM OVERSIGHT. The Heads of the DoD Components shall ensure that security 
education and training are appropriately evaluated during self-inspections and other oversight 
activities. This evaluation shall include assessing the quality and effectiveness of the efforts, as 
well as ensuring appropriate coverage of the target populations. The Heads of the DoD 
Components shall require maintaining records of education and training offered and employee 
participation, as they deem necessary to permit effective oversight. 
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ENCLOSURE 6 


SECURITY INCIDENTS INVOLVING CLASSIFIED INFORMATION 


1. INTRODUCTION. Protection of classified information is essential to maintaining security 
and achieving mission success in DoD operational and warfighting environments. Prompt 
reporting of security incidents ensure that such incidents are properly investigated and the 
necessary actions are taken to negate or minimize the adverse effects of an actual loss or 
unauthorized disclosure of classified information and to preclude recurrence through an 
informed, properly tailored, and up-to-date security education and awareness program. In cases 
where compromise has been ruled out and there is no adverse effect on national security, a 
common sense approach to the early resolution of an incident at the lowest appropriate level is 
encouraged. All security incidents involving classified information shall involve a security 
inquiry, a security investigation, or both. 


a. The terms associated with security incidents are formally defined in the Glossary, but to 
ensure common understanding, the following general characterizations are provided: 


(1) Infraction. An infraction is a security incident involving failure to comply with 
requirements (i.e., the provisions of References (d) and (f), this Manual or other applicable 
security policy) which cannot reasonably be expected to, and does not, result in the loss, 
suspected compromise, or compromise of classified information. An infraction may be 
unintentional or inadvertent. While it does not constitute a security violation, if left uncorrected, 
can lead to security violations or compromises. It requires an inquiry to facilitate immediate 
corrective action but does not require an in-depth investigation. 


(2) Violation. Violations are security incidents that indicate knowing, willful, and 
negligent for security regulations, and result in, or could be expected to result in, the loss or 
compromise of classified information. Security violations require an inquiry and/or 
investigation. 


(a) Compromise. A compromise is a security incident (more specifically, a 
violation) in which there is an unauthorized disclosure of classified information (i.e., disclosure 
to a person(s) who does not have a valid clearance, authorized access, or a need to know). 


(b) Loss. A loss occurs when classified information cannot be physically located or 
accounted for (e.g., classified information/equipment is discovered missing during an audit and 
cannot be immediately located). 


(3) Inquiry. An inquiry is fact-finding and analysis conducted to determine whether or 
not there was a loss of classified information or whether or not unauthorized personnel had, or 
could have had, access to the information. The inquiry identifies the facts, characterizes the 
incident as an infraction or a violation, identifies if possible the cause(s) and person(s) 
responsible, reports corrective actions taken or to be taken, and makes recommendations as to the 
need for further corrective action or a more in-depth investigation. Inquires, generally, are 
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initiated and conducted at the lowest echelon possible within the DoD Component. 


(4) Investigation. An investigation is conducted for a security violation when the 
incident cannot be resolved via inquiry or for incidents where an in-depth and comprehensive 
examination of the matter is appropriate. 


b. Certain practices dangerous to security, while not reportable as security incidents, have 
the potential to jeopardize the security of classified information and material if allowed to 
perpetuate. Examples of such practices are: placing a paper recycling box next to a classified 
copier or placing burn bags next to unclassified trash containers; stopping at a public 
establishment to conduct personal business while hand-carrying classified information; or failing 
to change security container combinations promptly when required. These practices, when 
identified, must be promptly addressed by security management and appropriate changes made, 
actions taken, or training provided, to ensure the security of classified information. 


2. CONSEQUENCES OF COMPROMISE. The compromise of classified information presents 
a threat to the national security and may damage intelligence or operational capabilities; lessen 
the DoD ability to protect critical information, technologies, and programs; or reduce the 
effectiveness of DoD management. Once a compromise is known to have occurred, the 
seriousness of damage to U.S. national security or the extent of the adverse affect on the national 
security must be determined and appropriate measures taken to negate or minimize the adverse 
effects. When possible, action shall also be taken to regain custody of documents or material 
that was compromised. In all cases, security management must take appropriate action to 
identify the source and reason for the suspected or actual compromise and take remedial action 
to prevent recurrence. 


3. REPORTING AND NOTIFICATIONS 


a. Anyone finding classified information out of proper control shall, if possible, take custody 
of and safeguard the material and immediately notify the appropriate security authorities. Secure 
communications should be used for notification whenever possible. 


b. Every civilian employee and Active, Reserve, and National Guard Military member of the 
Department of Defense, and every DoD contractor or employee of a contractor working with 
classified material, as provided by the terms of the contract, who becomes aware of the loss or 
potential compromise of classified information shall immediately report it to the head of his or 
her local activity and to the activity security manager. 


c. If the person believes that the head of the activity or the security manager may have been 
involved in or responsible for the incident, he or she may report it to the security authorities at 
the next higher level of command or supervision. If circumstances of discovery make such 
notification impractical, the individual shall notify the commanding officer or security manager 
at the most readily available DoD facility or contact any DoD law enforcement, 
counterintelligence (CI), or Defense criminal investigative organization (DCIO). 
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d. Activity security officials shall advise their chain of command of compromises occurring 
within their area of security responsibility or involving assigned personnel. 


e. If the head of an activity or the activity security manager to whom an incident is initially 
reported does not have security cognizance over the incident, such official shall ensure that the 
incident is reported to the appropriate authority. The organization with security cognizance shall 
ensure that an inquiry and, when appropriate, investigation are conducted, as needed, consistent 
with the requirements of this enclosure and corrective action is taken as required. 


f. Reporting confirmed security incidents to the Director of Security, OUSD(I&S), is 
necessary when the incidents have or may have significant consequences or the fact of the 
incident may become public. Such incidents shall be reported promptly through appropriate 
security channels by the DoD Component senior agency official. When appropriate, preliminary 
reports shall be provided, particularly when the fact of the incident may become public or attract 
media attention. 


(1) The Director of Security, OUSD(I&S), shall be notified of: 

(a) A violation involving espionage. 

(b) An unauthorized disclosure of classified information in the public media. See 
section 7 of this enclosure for information required in the notification. Additional notification is 
not required for reference to or republication of a previously identified media disclosure. 

(c) Any violation wherein properly classified information is knowingly, willfully, or 


negligently disclosed to unauthorized persons or information is classified or continues to be 
classified when that violation: 


i 


. Is reported to the oversight committees of Congress; 


2. May attract significant public attention; 


[eS] 


. Involves large amounts of classified information; or 


4. Reveals a potential systemic weakness in classification, safeguarding, or 
declassification policy or practices. 


(d) Any violation wherein a SAP is knowingly, willfully, or negligently created or 
continued contrary to the requirements of Reference (ag), DoDI 5205.11 (Reference (bh)), this 
Manual, and national policies. 


(e) A security failure or compromise of classified information relating to any defense 
operation, system, or technology that is likely to cause significant harm or damage to U.S. 
national security interests, for which Congressional reporting may be required by section 2723 of 
title 10, U.S.C. (Reference (bi)). 
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(f) Other egregious security incident (as determined by the DoD Component senior 
agency official). 


(2) Security incidents that do not meet the reporting criteria specified above shall be filed 
in a retrievable format by the DoD Component and shall be available for inspection or further 
analysis, review, and potential investigation. 


(3) On behalf of the Secretary of Defense, the USD(I&S) shall notify Congress and the 
Director, ISOO, regarding specific cases or incidents as required by References (d) and (bi). 


(4) The Director of Security, OUSD(I&S), shall coordinate with the Office of the DNI 
(ODNJ National Counterintelligence Executive (NCIX) as needed to ensure notifications 
required by Intelligence Community Directive 701 (Reference (bj)) are made. 


4. CLASSIFICATION OF REPORTS 


a. Security incident reports shall be classified according to the content of the report and at 
the level prescribed by the applicable program security classification guides. At a minimum, 
reports shall be designated FOUO and marked as required by Volume 4 of this Manual, in order 
to provide appropriate protection for information regarding personnel involved and information 
that could facilitate unauthorized access to classified information. If the lost or compromised 
information is beyond the jurisdiction of the U.S. Government and cannot be recovered (e.g., 
media leak, public website posting, or loss in a foreign country), the report and location of the 
compromise (e.g., geographic location of unrecoverable equipment) shall be classified 
commensurate with the classification level of the compromised material to prevent further 
unauthorized disclosure. 


b. If an FOUO report is to be disseminated outside the Department of Defense (e.g., to 
another Federal agency), the face of the document shall bear an expanded marking, as specified 
in Enclosure 3 of Volume 4 of this Manual, stating that the information may be exempt from 
mandatory disclosure pursuant to section 552 of title 5, U.S.C. (also known as “The Freedom of 
Information Act” and hereinafter referred to as “FOIA” (Reference (bk))). 


c. Reports, whether classified or unclassified, disclosing technical data shall be marked with 
the appropriate distribution statement as described in DoDI 5230.24 (Reference (bl)) or 
associated with the information involved in the incident. 


5. SPECIAL CIRCUMSTANCES. Certain types of classified information or specific 
circumstances require unique handling or consideration of additional reporting requirements as 
specified in paragraphs 5.a through 5.0. 


a. Security Incidents Involving Deliberate Compromise, a Foreign Intelligence Service or a 
Terrorist Organization. Any incident in which deliberate compromise of classified information 
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or involvement of a foreign intelligence service, international terrorist group, or organization is 
suspected shall be reported immediately to the cognizant Defense CI component, in accordance 
with DoDD 5240.06 (Reference (bm)). Security officials shall not initiate or continue an inquiry 
or investigation of the incident unless it is fully coordinated with the cognizant Defense CI 
component. 


b. Security Incidents Involving Apparent Violations of Criminal Law. Any incident in 
which an apparent violation of criminal law is suspected, but which is reasonably not believed to 


be espionage or involving matters described in paragraph 5.a of this section, shall be reported 
immediately to the local DCIO. If that organization accepts jurisdiction and initiates action, 
coordinate with them prior to taking any further action on the security inquiry or investigation so 
as not to jeopardize the integrity of either investigation. 


c. Security Incidents Involving COMSEC or Cryptologic Information. Actual or potential 
compromises involving cryptographic information shall be handled according to NSTISSI 4003 
(Reference (bn)). 


d. Security Incidents Involving SCI. Actual or potential compromises involving SCI shall be 
reported to the activity SSO and handled in accordance with References (i) and (bj). 


(1) Incidents involving SCI that meet the criteria in paragraph 3.f of this enclosure shall 
also be reported to the Director of Security, OUSD(I&S). 


(2) If aDoD Component believes a disclosure may contain classified SCI information 
under the control of an(other) Intelligence Community agency, the DoD Component shall notify 
NCIX. NCIX shall coordinate notification to the affected agency. 


e. Security Incidents Involving RD and/or FRD. In accordance with the provisions of 
section 3161 of Public Law 105-261 (Reference (bo)), and its implementing plan, the Secretary 
of Energy must report to Congress inadvertent disclosure of RD or FRD occurring pursuant to 
automatic declassification processes. Components shall notify the Department of Energy as 
necessary and provide a copy of the notification to the Deputy Assistant Secretary of Defense for 
Nuclear Matters and the Director of Security, OUSD(I&S). 


f. Security Incidents Involving IT. Actual or potential compromises of classified 
information involving IT, automated information systems, or computer systems, terminals, or 
equipment shall be reported, in accordance with Reference (v), through appropriate channels by 
the IA manager (IAM) to the activity security manager. Inquiries into and resolution of incidents 
involving compromise of classified information resident on computers or in IT systems require 
coordination with and assistance from the local IA officials, but prompt resolution remains the 
responsibility of the activity security manager. See Enclosure 7 for additional guidance on 
handling of classified data spills. 


g. Security Incidents Involving FGI or NATO Information. Actual or potential compromises 
involving FGI or NATO information shall also be reported promptly by the DoD Component 
senior agency official to the USD(P), who serves as the DSA. The Director, International 
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Security Programs, Defense Technology Security Administration, OUSD(P), shall be 
responsible, on behalf of the DSA, for notifying and coordinating with NATO or the foreign 
government, as appropriate. 


h. Security Incidents Involving Classified U.S. Information Provided to Foreign 
Governments. Actual or potential compromises of U.S. classified information held by foreign 


governments shall be reported to the originating DoD Component, the OCA, the Director of 
Security, OUSD(I&S), and the Director, International Security Programs, Defense Technology 
Security Administration, OUSD(P). 


i. Security Incidents Involving SAPs. Actual or potential compromises involving DoD 
SAPs, or results of inquiries and/or investigations that indicate that weaknesses or vulnerabilities 
in established SAP policy and/or procedures contributed to an actual or potential compromise, 
shall be reported by the DoD Component SAP program office to the DoD SAP Central Office, 
which shall report to the Director of Security, OUSD(I&S). 


j. Security Incidents Involving Improper Transfer of Classified Information. Any activity 
that receives classified information that has been improperly handled, addressed, packaged, 


transmitted, or transported shall make a determination as to whether the information has been 
subjected to compromise. If the activity determines that the classified information has been 
subjected to compromise, the receiving activity shall immediately notify the sending activity, 
which shall be responsible for initiating an inquiry or investigation, as appropriate. The 
receiving activity shall share information generated regarding the incident with the sending 
activity. The sending activity is responsible for required notifications (e.g., to the OCA). 
Classified information shall be considered as having been subjected to compromise if it has been 
handled through foreign postal systems, its shipping container has been damaged to an extent 
that the contents are exposed, or it has been transmitted (e.g., telephone, facsimile, message, e- 
mail, computer or data links) over communications circuits that are not approved for 
transmission of classified information. If the receiving activity determines that classified 
information was not in fact compromised, but was nevertheless improperly prepared or 
transferred, the receiving activity shall report the discrepancy to the sending activity. 


k. Security Incidents Involving On-Site Contractors. Security incidents, including any 
inquiries or investigations required, involving on-site contractors shall be handled in accordance 


with paragraph C1.1.9 of Reference (az). As specified by paragraph C1.1.9 of Reference (az) 
and paragraph 6-105c of Reference (w), host activity security rules and procedures apply. 
Disciplinary action and sanctions are the responsibility of the contractor’s company unless 
specific contract provisions address such actions. Security managers shall furnish the results of 
inquiries to the company, with a copy to Defense Security Service, in order to facilitate such 
action. Specified U.S. Government officials retain the ability, when appropriate and in 
accordance with the authorities and requirements of Reference (az), to deny access to classified 
information, to revoke or suspend security clearances, and to take certain other administrative 
actions, such as to deny an individual continued access to the facility. 


l. Security Incidents Involving Critical Program Information (CPI). Upon learning that 


classified CPI or CPI related to classified contracts may have been or was actually compromised, 
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security officials shall inform the program manager of record and the cognizant Defense CI 
component pursuant to DoDD 5240.02 (Reference (bp)). The specific CPI involved in the 
incident should be identified in inquiry and investigation reports. Classify reports as required by 
the applicable program security classification guide(s). 


m. Security Incidents Involving ACCM-Protected Information. Security officials shall refer 
to section 18 of Enclosure 2 of this Volume for additional guidance on security incidents 
involving ACCM-protected information as well as safeguarding and handling of ACCM- 
protected information. 


n. Absence Without Authorization. When an individual who has had access to classified 
information is absent without authorization, the head of the activity or security manager shall 
determine if there are indications of activities, behavior, or associations that could indicate 
classified information may be at risk. If so, the supporting Defense CI component shall be 
notified in accordance with Reference (bp). The scope and depth of the inquiry shall depend on 
the length of absence and the sensitivity of the classified information involved. Missing 
personnel authorized SCI access shall be reported in accordance with Reference (i). 


o. Coordination with Legal Counsel and the Department of Justice (DoJ). Whenever formal 
action, beyond adjudication of a finding of a security violation and assignment of reprimand or 
disciplinary action at the activity level is contemplated against any person believed responsible 
for the unauthorized disclosure of classified information, DoD Component officials shall 
coordinate with servicing legal counsel. Whenever a criminal violation appears to have occurred 
and a criminal prosecution is contemplated, Component officials shall use established procedures 
and channels to ensure coordination with the legal counsel of the DoD Component or Federal 
agency where the individual is assigned or employed and the DoJ. 


6. SECURITY INQUIRIES AND INVESTIGATIONS 


a. Requirement. All known or suspected instances of unauthorized disclosure of classified 
information shall be promptly addressed by the cognizant DoD Component to decide the nature 
and circumstances of the disclosure and the extent of damage to national security, and 
appropriate corrective action shall be taken. See Appendix 1 to this enclosure for a sample, 
optional format for use in documenting actions. Reports of inquiries and investigations, at a 
minimum, shall be designated and marked as FOUO. 


b. Coordination with Criminal Investigative Organization or Defense CI Component. When 
information suggestive of a criminal or CI nature is discovered, all actions associated with the 
inquiry or investigation shall cease pending coordination with the cognizant DCIO or Defense CI 
component. If the DCIO or Defense CI component accepts jurisdiction, the inquiry or 
investigation shall not be resumed without agreement of the cognizant criminal investigative 
organization or CI component. All relevant information shall be released with an annotation in 
the report that the matter was referred to the specific DCIO or Defense CI component. Notify 
the OCA, originator, and others as appropriate, after coordination with the DCIO or Defense CI 
component. If the DCIO or Defense CI component declines jurisdiction, the security inquiry or 
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investigation shall continue. Annotate the report appropriately and include the identity of the 
official who made the declination decision and his or her organization. 


c. Coordination with OCA 


(1) If the inquiry or investigation determines that a compromise occurred, the official 
initiating the inquiry or investigation shall immediately notify the originator (i.e., the OCA) of 
the information or material involved. The OCA(s) shall take the actions required by section 9 of 
this enclosure. 


(2) If the originating activity no longer exists, the activity that inherited the functions of 
the originating activity shall be notified. If the functions of the originating activity were 
dispersed to more than one other activity, the inheriting activity(ies) cannot be determined, or the 
functions have ceased to exist, the senior agency official of the DoD Component of which the 
originating activity was a part shall be notified. This notification shall not be delayed pending 
completion of any additional inquiry or investigation or resolution of other related issues. 


d. Security Inquiries. The head of the activity or activity security manager having security 
cognizance shall initiate an inquiry into the actual or potential compromise promptly to 
determine the facts and circumstances of the incident, and to characterize the incident as an 
infraction or a violation. At conclusion of the inquiry, a narrative of findings is provided in 
support of recommended additional investigative or other actions by the activity. 


(1) The official appointed to lead the inquiry shall not be anyone involved with the 
incident. Preferably, the security manager should not be appointed to lead the inquiry. 


(2) An inquiry shall be initiated and completed as soon as possible, not to exceed 10 duty 
days, and a report of findings provided to the activity head, activity security manager, and others 
as appropriate. If the inquiry cannot be completed within 10 duty days an extension should be 
requested from the appointing official. 


(3) No recommendation should be made by an inquiry officer with regard to punitive 
action against the individual(s) responsible for the violation. An inquiry officer’s function is to 
determine and report facts and make recommendations for actions needed to prevent future 
violations of the type investigated. Disciplinary or punitive action is the responsibility of the 
appropriate military commander or management official. 


(4) If information obtained as a result of the inquiry is sufficient to provide answers to 
the following questions, then such information shall be sufficient to resolve the incident, to 
include instituting administrative sanctions consistent with section 17, Enclosure 3 of Volume 1 
of this Manual. 


(a) When, where, and how did the incident occur? What persons, situations, or 
conditions caused or contributed to the incident? 


(b) Was classified information compromised? 


Change 3, 07/28/2020 93 ENCLOSURE 6 


163 


164 


DoDM 5200.01-V3, February 24, 2012 


(c) If a compromise occurred, what specific classified information and/or material 
was involved? What is the classification level of the information disclosed? 


(d) If classified material is alleged to have been lost, what steps were taken to locate 
the material? 


(e) Was the information properly classified? 
(f) Was the information officially released? 
(g) In cases of compromise involving the public media: 


1. In what specific media article, program, book, Internet posting or other item 
did the classified information appear? 


IN 


. To what extent was the compromised information disseminated or circulated? 


I 


Would further inquiry increase the damage caused by the compromise? 


(h) Are there any leads to be investigated that might lead to identifying the person(s) 
responsible for the compromise? 


(i) If there was no compromise, and if the incident was unintentional or inadvertent, 
was there a specific failure to comply with established security practices and procedures that 
could lead to compromise if left uncorrected and/or is there a weakness or vulnerability in 
established security practices and procedures that could result in a compromise if left 
uncorrected? What corrective action is required? 


e. Security Investigations. If the circumstances of an incident require a more detailed or 
additional investigation, then an individual shall be appointed by the activity head in writing, to 
conduct that investigation and, as appropriate, provide recommendations for any corrective or 
disciplinary actions. 


(1) The individual appointed shall be sufficiently senior to ensure a successful 
completion of the investigation and should be commensurate with the seriousness of the incident; 
have an appropriate security clearance; have the ability to conduct an effective investigation; and 
shall be someone unlikely to have been involved, directly or indirectly, in the incident. 


(2) Except in unusual circumstances, the activity security manager shall not be appointed 
to conduct the investigation. 


(3) As an investigation may lead to administrative or disciplinary action, the evidence 
developed should be comprehensive in nature and gathered in such a manner that it would be 
admissible in a legal or administrative proceeding. Consult local legal counsel as needed for 
procedural guidance on conduct of the investigation. 


Change 3, 07/28/2020 94 ENCLOSURE 6 


164 


165 


DoDM 5200.01-V3, February 24, 2012 


(4) The investigation should be accomplished promptly following appointment of the 
investigating officer. The results of the investigation shall be documented in writing. The 
format in Appendix 1 to this enclosure may be used. 


7. INFORMATION APPEARING IN THE PUBLIC MEDIA 


a. If classified information appears in the public media, including on public Internet sites, or 
if approached by a representative of the media, DoD personnel shall be careful not to make any 
statement or comment that confirms the accuracy of or verifies the information requiring 
protection. Report the matter as instructed by the appropriate DoD Component guidance, but do 
not discuss it with anyone who does not, in the case of classified information, have an 
appropriate security clearance and need to know. 


b. If the fact of an unauthorized public disclosure becomes widely know, the Component 
senior agency official should consider whether the workforce needs to be reminded of actions to 
be or not to be taken by individuals in response to the disclosure. Reminders may include such 
topics as not viewing or downloading the classified information from unclassified IT systems, 
not confirming the accuracy of the information, and providing a point of contact for media 
inquiries. 


c. Notifications of unauthorized disclosures of classified information in the public media 
required by subparagraph 3.f.(1)(b) of this enclosure shall include the information specified in 
subparagraphs 7.c.(1) through 7.c.(7). Initial notifications providing basic information about the 
incident and a point of contact should be made as quickly as is feasible; complete information 
should be provided subsequently. 


(1) Date, location, and author of the public media item. 

(2) Specific information disclosed and its classification level. 

(3) Identification of the OCA. 

(4) The extent to which the disclosed information was circulated, both within and outside 
the Department of Defense, and the number of persons known to have had access to the 


information. 


(5) An appraisal of or statement regarding the damage to national defense and/or national 
security programs caused by the disclosure. 


(6) A statement of whether any investigative leads exist and what additional actions, if 
any, are contemplated (i.e., no further action; administrative investigation by the DoD 
Component; referral to the cognizant DCIO for criminal investigation; or a request for 
USD(1&S) referral to DoJ for investigation). 
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(7) Point of contact for further information. 


d. When notified of a suspected compromise of classified information through the public 
media, the USD(I&S) shall, unless already done by the reporting DoD Component, consult with 
the Assistant Secretary of Defense for Public Affairs and other officials having a primary interest 
in the information to determine if the information was officially released under proper authority. 


e. When responsibility for an inquiry into an unauthorized public media disclosure is unclear 
or is shared equally with another DoD Component, refer the matter through security channels to 
the USD(I&S) who shall decide investigative responsibility in consultation with the affected 
DoD Components. 


f. The decision on whether to initiate an additional investigation by a DCIO or by the 
Federal Bureau of Investigation through a referral to the DoJ shall be based on the following 
factors: 


(1) The accuracy of the information disclosed. 


(2) The damage to national security caused by the disclosure and whether there were 
compromises regarding sensitive aspects of current classified projects, intelligence sources, or 
intelligence methods. 


(3) The extent to which the disclosed information was circulated, both within and outside 
the Department of Defense, and the number of persons known to have access to it. 


(4) The degree to which an investigation shall increase the damage caused by the 
disclosure. 


(5) The existence of any investigative leads. 


(6) The reasonable expectation of repeated disclosures. 


g. If the DoD Component’s initial inquiry or investigation or a DCIO investigation identifies 
the person(s) responsible for an unauthorized disclosure of classified information via the public 
media or Internet, the DoD Component shall notify the Director of Security, OUSD(U&S). This 
notification shall include responses to the DoJ Media Leak Questionnaire (see Appendix 2 of this 
enclosure). The USD([&S), in coordination with the General Counsel of the Department of 
Defense (GC, DoD) and the Head of the DoD Component having OCA, shall decide whether 
additional investigation is appropriate and whether to refer the unauthorized disclosure to the 
DoJ for investigation and/or criminal prosecution. When the initial inquiry or investigation does 
not identify the person responsible, the Head of the DoD Component, in consultation with the 
USD([&S) and the GC, DoD, shall decide if further investigation is appropriate. 


8. RESULTS OF INQUIRIES AND INVESTIGATIONS 
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a. If the conclusion of the inquiry or investigation is that a compromise occurred and that 
weakness or vulnerability in established security practices and/or procedures contributed to the 
compromise or that the potential exists for a compromise of classified information due to a 
weakness or vulnerability in established security practices and/or procedures, the appropriate 
responsible security official shall take prompt action to issue new or revised guidance, as 
necessary, to resolve identified deficiencies. Results of inquiries and/or investigations into actual 
or potential compromises that indicate that defects in the procedures and requirements of this 
Manual contributed to the incident shall be reported to the Director of Security, OUSD(I&S). 


b. If the conclusion of the inquiry or investigation is that a compromise did not occur, but 
that there was potential for compromise of classified information due to a failure of a person or 
persons to comply with established security practices and/or procedures, the official having 
security responsibility over such persons shall be responsible for taking action as may be 
appropriate to resolve the incident. 


c. Additional investigation, beyond what is required by this enclosure, may be needed to 
permit application of appropriate sanctions for violation of regulations, criminal prosecution, or 
determination of effective remedies for discovered vulnerabilities. The inquiry this enclosure 
requires may serve as part of these investigations, but notifying OCAs shall not be delayed 
pending completion of these additional investigations. 


9. ACTIONS TO BE TAKEN BY THE OCA. When notified of the compromise of classified 
information, the OCA shall: 


a. Verify the classification and duration of classification initially assigned to the information. 


b. Reevaluate the classification assigned to determine whether the classification shall be 
continued or changed. This classification review shall consider the following possibilities: 


(1) The information has lost all or some of its sensitivity since it was initially classified 
and should be downgraded or declassified. (In rare cases, it might also be discovered that the 
information has gained sensitivity and should be upgraded.) 


(2) The information has been so compromised by the incident that attempting to protect 
it further as classified is unrealistic or inadvisable, and it should be declassified. 


(3) The information should continue to be classified at its current level. 


c. Advise the activity reporting the compromise of the outcome of the classification 
assessment required by paragraphs 9.a and 9.b of this section within 72 hours of notification. 


d. Assess the impact of the compromise on the affected system, plan, program, or project; 


consider countermeasures (e.g., damage control actions) that may be taken to minimize, mitigate 
or limit damage to national security and prevent further loss or compromise; and then initiate or 


Change 3, 07/28/2020 97 ENCLOSURE 6 


167 


168 


DoDM 5200.01-V3, February 24, 2012 


recommend adoption of such countermeasures. 


(1) Where appropriate, countermeasures should be applied as quickly as possible and 
may be initiated prior to completion of the classification review or damage assessment. 


(2) Countermeasures could include changing plans or system design features, revising 
operating procedures, providing increased protection to related information (e.g., classification 
upgrading), or other appropriate actions. 


(3) Evaluate the cost implications of information, operational, or technology losses; 
developmental and integration costs of countermeasures; likelihood of countermeasure success; 
and programmatic impacts of the unmitigated loss and/or compromise of specific classified 
information. 


e. Conduct a damage assessment as required by section 10 of this enclosure to determine the 
effect of the compromise of classified information on the national security. 


10. DAMAGE ASSESSMENTS 


a. A damage assessment is undertaken to determine the effect of a compromise on the 
national security. 


(1) A damage assessment shall normally consist of a detailed, multidisciplinary 
examination of the facts surrounding the compromise to determine the practical effects of a 
compromise on DoD programs, operations, systems, materials, and intelligence and on the 
Department of Defense’s ability to conduct its missions; to address mitigations and 
countermeasures that could be put in place to decrease or offset the impact; to determine the 
estimated dollar costs to implement countermeasures essential to maintain or reinstate security, 
or to replace weapons systems or capabilities that are thoroughly compromised; and to provide, 
when appropriate, specific recommendations for action. 


(2) A damage assessment is conducted after the classification review and often follows 
any prosecutorial actions. However, when necessary to identify damage done by the disclosure 
or otherwise appropriate, a damage assessment may be conducted pre-prosecution. 


(3) The damage assessment is not to be confused either with the classification review 
performed by the OCA or with damage control actions, which are those actions performed 
immediately upon the discovery of disclosure or compromise to minimize risk, limit damage, 
and/or prevent further loss or compromise. 


b. Each DoD Component shall establish a system of controls and internal procedures to 
ensure that damage assessments are conducted, at a minimum, for cases of compromise 
involving espionage, intelligence information or compromise via the public media. Damage 
assessments are encouraged for other compromises. 
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(1) Conduct of the damage assessment is the responsibility of the OCA and subject 
matter experts. Security officials should provide assistance as needed and appropriate. 


(2) The results of relevant security inquiries and investigations shall be made available to 
inform the damage assessment process, as needed. Reports of criminal or CI investigations 
associated with the compromise should be requested by the OCA from the cognizant DCIO or 
Defense CI component. 


11. VERIFICATION, REEVALUATION, AND DAMAGE ASSESSMENT TIMELINES. The 
verification and reevaluation steps in section 9 of this enclosure, and when appropriate the 
damage assessment process in section 10 of this enclosure, shall be completed as soon as 
possible following notification of a compromise. However, damage assessments requiring multi- 
disciplinary or multiple agency review of the adverse effects of the compromise on systems, 
operations, and/or intelligence, may sometimes be a long-term process. The DoD goal for 
completion of a damage assessment involving compromised classified information is no longer 
than 6 months from the first date the compromise was declared. Accomplishment of the 
assessment prior to the initiation of legal or administrative proceedings may be beneficial; check 
with legal counsel. 


12. ACTUAL OR POTENTIAL COMPROMISES INVOLVING MORE THAN ONE 
AGENCY. When classified information under the control of more than one DoD Component or 
another Federal agency is involved, the affected activities are responsible for coordinating their 
efforts in evaluating the classification of information involved and assessing damage. 


13. DEBRIEFING IN CASES OF UNAUTHORIZED ACCESS. In cases where unauthorized 
access to classified information has occurred, it may be advisable to discuss the situation with the 
individual(s) to enhance the probability that he or she shall properly protect it. The activity head 
shall determine if a debriefing is warranted. This decision shall be based on the circumstances of 
the incident, what is known about the person(s) involved, and the nature of the information. The 
following general guidelines apply: 


a. If the unauthorized access was by a person with the appropriate security clearance but no 
need to know, debriefing is usually appropriate only so far as necessary to ensure that the 
individual is aware that the information to which they had unauthorized access is classified and 
requires protection. 


b. If the unauthorized access was by U.S. Government civilian or military personnel or an 
employee of a U.S. Government contractor, who does not have a security clearance, debriefing is 
usually appropriate. The person shall be advised of his or her responsibility to prevent further 
dissemination of the information and of the administrative sanctions and criminal penalties that 
might follow if he or she fails to do so. The debriefing shall be designed to ensure that the 
individual understands the nature of the information, why its protection is important, and knows 
what to do if someone tries to obtain the information. In the case of non-DoD U.S. Government 
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personnel and employees of U.S. Government contractors, the appropriate security official in the 
individual’s parent organization, including the appropriate facility security officer where 
applicable, shall be advised of the debriefing. 


c. If the person involved is neither a member of a U.S. Government organization nor an 
employee of a U.S. Government contractor, the decision is much more situational. The key 
question is whether the debriefing shall have a positive effect on the person’s ability or 
willingness to protect the information. 


d. In any case where the person to be debriefed may be the subject of criminal prosecution or 
disciplinary action, consult with legal counsel before attempting to debrief the individual. 


e. It is sometimes useful to have the person being debriefed sign a statement acknowledging 
the debriefing and his or her understanding of its contents, or to execute a SF 312. If an NDA is 
not executed, the nature and format of the statement is left to the discretion of the local security 
official to allow flexibility in meeting the requirements of a particular incident. If the person 
refuses to sign an NDA or debriefing statement when asked, this fact and his or her stated 
reasons for refusing shall be made a matter of record in the inquiry. 


14. REPORTING AND OVERSIGHT MECHANISMS. The DoD Components shall establish 
necessary reporting and oversight mechanisms to ensure that inquiries and/or investigations are 
conducted when required, that they are done in a timely and efficient manner, and that 
appropriate management action is taken to correct identified problems. Inquiries or 
investigations and management analyses of security incidents shall consider possible systemic 
shortcomings that may have caused or contributed to the incident. The effectiveness of activity 
security procedures, security education, supervisory oversight of security practices, etc., shall be 
considered in determining causes and contributing factors. The focus of management response 
to security incidents shall be to eliminate or minimize the probability of further incidents 
occurring. Appropriate disciplinary action or legal prosecution, as discussed in section 17, 
Enclosure 3 of Volume 1 of this Manual, is sometimes one means of doing this, but the broader 
focus on prevention shall not be lost. Simple disciplinary action, without consideration of what 
other factors may have contributed to the situation, shall not be considered an acceptable 
response to a security incident. 


Appendixes 


1. Security Incident Reporting Format 
2. DOJ Media Leak Questionnaire 
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APPENDIX 1 TO ENCLOSURE 6 


SECURITY INCIDENT REPORTING FORMAT 


1. The report format as described in Figure 2 is optional, to be used as a guide for appropriate 
content. The format may be used as shown or tailored to suit the organization and the 
circumstances. In all cases, the goal is to identify who, what, when, where, why, and how the 
incident occurred and to determine what should be done to preclude similar incidents in the 


future. 


2. Classify, and appropriately mark, security incident reports according to content. At a 
minimum, reports shall be designated and marked “FOR OFFICIAL USE ONLY” as the reports 
will contain information on personnel involved. The reports may also contain other information 
that qualifies for designation as FOUO and information that could facilitate unauthorized access 
to classified information. 
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Figure 2. Report of Security Incident Inquiry or Investigation 


TO: Official Initiating Inquiry or Investigation (e.g., Activity Security Manager or Activity Head) (others as 
required) 


THRU: (Appropriate chain of command) 
SUBJECT: Report of Security Incident Inquiry or Investigation 


1. Summary: A summary of who, what, when, where, why, and how the violation occurred. (Also see DoD 
Manual 5200.01-V3, section 6 of Enclosure 6.) 


2. Sequence of Events: A detailed sequence of events tracing the security violation from start to finish. This 
sequence will include a list of all personnel (include name, grade, social security number (for positive identification 
and adverse information reporting), position, organization, clearance level, and access authorized) involved in order 
of their specific time of involvement; and all locations involved. 


a. Indicate date of violation’s discovery and likely occurrence (if known). Identify the material (e.g., 
documents, information, or equipment) involved in the violation. Identify individuals not cleared for classified 
information and the extent of exposure. Identify procedural problems or other factors that may have contributed to 
the violation. 


b. Provide a detailed description of the information involved in the incident. Include classification, 
compartment levels, caveats and any control or dissemination notices; identification of the material (e.g., message, 
letter, staff study, imagery, magnetic media, equipment item) by subject and date or nomenclature, to include any 
control/serial numbers; originating office and OCA; and volume of material (e.g., number of pages or items of 
equipment) involved. 


c. Make a statement as to the likelihood of compromise. If material has been compromised, identify the 
extent of compromise and state the date or time period during which information was lost or compromised. Identify 
by name the individual(s) and organization(s) of personnel at fault for, or contributing to, the violation, if possible, 
and reason(s) they are culpable or contributed to the occurrence of a violation. 


d. Identify deficient procedure(s) and describe how they led or contributed to the incident (too vague, 
weak, out-of-date, unenforceable, ineffective, etc.). Include any assessment regarding systemic weaknesses or 


vulnerabilities in established security practices (e.g., non-existent, out-of-date, or ineffective policies, procedures or 
training) that must be corrected; suggest the corrective actions required. 


3. Actions taken: List actions that have been taken (e.g., notifications made, messages sent, interviews with, 
counseling of, and discipline rendered for individuals involved, and other information as required). Include dates 


inquiry or investigation started and ended. 


4. Recommendations: Make recommendations concerning what should be done to preclude future incidents of this 
type. 


5. Identification of inquiry or investigating official, organization, and telephone numbers. 
6. Evaluation notes. Enter other information relevant to the inquiry or investigation. Attach interview statements 
and/or records, documentary evidence, exhibits and so forth, as appropriate. 

(Signature of Inquiry or Investigating Official) 


FOR OFFICIAL USE ONLY (or, if classified, insert classification and add other markings as required) 
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APPENDIX 2 TO ENCLOSURE 6 


DOJ MEDIA LEAK QUESTIONNAIRE 


If the initial inquiry and/or investigation into an unauthorized disclosure of classified information 
via the media identifies the person responsible for the unauthorized disclosure, the Head of the 
DoD Component shall promptly answer to the fullest extent possible the standard questions in 
this appendix, which comprise the DoJ Media Leak Questionnaire, and submit the questionnaire 
through security channels to the USD(I&S). In coordination with the GC, DoD, the USD([&S) 
shall, when warranted, forward the information via letter to: 


Department of Justice, Criminal Division 
Attention: Chief, Internal Security Section 
Bond Building, Room 9400 

1400 New York Avenue, NW 
Washington, DC 20530 


a. What is the date and identity of the media source (e.g., article, blog, television, or other 
oral presentation) containing classified information? 


b. What specific statement(s) in the media source are classified and was the information 
properly classified? 


c. Is the classified information disclosed accurate? 

d. Did the information come from a specific document, and if so, what is the origin of the 
document and the name of the individual responsible for the security of the classified data 
discussed? 

e. What is the extent of official circulation of the information? 


f. Has the information been the subject of prior official release? 


g. Was prior clearance for publication or release of the information sought from proper 
authorities? 


h. Has the material, parts thereof or enough background data, been published officially or in 
the press to make an educated speculation on the matter possible? 


i. Will the information be made available for use in a prosecution, and if so, what is the 
name of the person competent to testify on its classification? 


j. Was declassification considered or decided on before the data appeared in the media? 


k. What effect might the disclosure of the classified data have on the national defense? 
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ENCLOSURE 7 


IT ISSUES FOR THE SECURITY MANAGER 


1. OVERVIEW. This enclosure identifies and discusses the most common IT issues facing 
security organizations and provides references and pointers to the relevant primary sources. As 
the Internet, classified and unclassified networks, and a wide range of computer systems are used 
in every facet of the operation of the Department of Defense, challenges and questions related to 
IT issues and the interaction between the security and IT staffs abound. The traditional security 
manager’s portfolio, planning horizon, and focus on classification management and personal, 
physical, and operational security issues no longer suffice. The continuing protection and 
security of complex IT and information systems depends upon a robust and effective interaction 
and coordination between security and IT organizations. 


2. RESPONSIBILITY. In accordance with Reference (b), overall security responsibility for 
protection of classified information and CUI remains with the information security program and 
staff, even though the data and/or information resides on IT and information systems and 
networks managed and controlled by the DoD Component Chief Information Officer. 
Accordingly, proactive and continuous engagement and collaboration between security, IT, and 
IA professionals, at all organizational levels, is essential in order to ensure the protection of DoD 
information as well as the Department’s electronic enterprise. 


3. IA ROLES AND FUNCTIONS 


a. In accordance with Reference (v) and DoDD 8000.01 (Reference (bq)), IA and IT policy 
and information systems operations are the purview of the Chief Information Officer of the 
Department of Defense at the OSD level and the counterpart organizations in the DoD 
Components. 


b. U.S. Strategic Command, through U.S. Cyber Command (USCYBERCOM), has the 
overall responsibility for directing the operation of and assuring the security of the global DoD 
network environment. USCYBERCOM will lead the day-to-day defense and protection of the 
DoD networks and will coordinate all DoD network operations, providing full spectrum support 
to military and counterterrorism missions. 


c. At the DoD Component and activity level, there are several important IA roles and 
functions that security managers need to recognize and understand to develop a productive 
relationship with the IA staff, including the designated approving authority (DAA), IAM, and IA 
officer (IAO). The Glossary provides definitions of these functions and identifies other titles that 
are sometimes used for these same functions. 


4. IA CONCEPTS 
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a. IA Attributes. All DoD information systems are to maintain appropriate levels of 
availability, integrity, authentication, confidentiality, and non-repudiation in order to protect and 
defend DoD information and networks. While all five of these attributes are critical to the user’s 
ability to perform the assigned mission, from an information security perspective, confidentiality 
and authentication may be the most important. 


(1) The loss of availability means that the information system, computer network, and/or 
data are unavailable to authorized users, and missions or operations cannot be performed. Loss 
of availability within a computing environment may be an extremely serious event, depending on 
the criticality of the applications and missions supported. 


(2) The loss of integrity means that the data can no longer be trusted to be reliable or 
accurate. 


(3) Authentication is critical, as it is the mechanism that authorizes or allows access to 
computer systems and networks and the data that resides there. Loss of or incorrect 
authentication services could allow unauthorized access to classified data. 


(4) The loss of confidentiality means that data may be available in an electronic form to 
users who are not authorized to receive it. Depending on the classification level of the system or 
network, loss of confidentiality could mean a compromise of classified information. 


(5) The loss of non-repudiation assurances means that authorized users no longer can be 
certain with whom they are communicating because general communications (and therefore the 
data processed by that information system) cannot be trusted or verified. 


b. System Categorization. Each information system must be categorized and have 
appropriate IA controls assigned in accordance with Reference (v). System categorization 
requires determination of the potential impacts of the loss of confidentiality, integrity, and 
availability associated with the specific system or information. IA controls are selected based on 
the results of the system categorization process. Security personnel may find it helpful to 
understand the categorization of the DoD information system(s) within their area of 
responsibility, as those designations impact the information, physical, personal, and operational 
security environment and the resource requirements that must be dedicated to protection of the 
system(s) and the information processed. 


c. Certification and Accreditation (C&A). C&A of DoD systems is governed by 
Reference (s). 


(1) Certification is the comprehensive evaluation of the technical and nontechnical (e.g., 
procedural) security safeguards of an information system undertaken to support the accreditation 
process. It establishes the extent to which a particular design and implementation meets a set of 
specified security requirements. 


(2) Accreditation is the formal declaration by a DAA that, based on the implementation 


Change 3, 07/28/2020 105 ENCLOSURE 7 


15 


1/6 


DoDM 5200.01-V3, February 24, 2012 


of a specified set of technical, managerial, and procedural safeguards, the level of risk is 
acceptable and the information system is approved to operate at a specific security level. 


(3) The security manager and the DAA should coordinate with each other during the 
C&A process. The DAA needs to work with the security organization to ensure an 
understanding of the security requirements that must be met based on the classification of the 
information to be processed, and for identification of any security issues associated with the 
operation of the system. The security staff, on the other hand, must be aware of the nature, 
scope, and schedule of ongoing C&A activities within a given organization, in order to provide 
timely and relevant classification management direction and to ensure the physical environment 
is properly secured and accredited for the operations planned and that users are properly cleared 
and have all requisite access in time to support the mission. 


5. DATA SPILLS 


a. Classified data spills occur when classified data is introduced either onto an unclassified 
information system or to an information system with a lower level of classification, or to a 
system not accredited to process data of that restrictive category. Although it is possible that no 
unauthorized disclosure occurred, classified data spills are considered and handled as a possible 
compromise of classified information involving information systems, networks, and computer 
equipment until the inquiry determines whether an unauthorized disclosure did or did not occur. 


b. When a classified data spill occurs, the activity security manager is responsible ensuring 
that the policy requirements for addressing an unauthorized disclosure, as specified in Enclosure 
6 or other provisions of this Manual, are met (e.g., inquiry, notification, investigation, damage 
assessment); however, these responsibilities must be carried out in close coordination with the IT 
and/or IA staff, which has overall responsibility for the operation of the networks and systems as 
well as the technical knowledge needed to address the spill. Security personnel have the overall 
lead for addressing such events. 


c. CNSS Policy 18 (Reference (br)) applies to the spillage of classified national security 
information on any information system, be it government, contractor, or privately owned, and 
provides a policy framework for the consistent handling of the spillage. Each Federal 
Government organization that owns or operates classified information systems is required to 
establish policies and procedures for handling classified information spillage. When a classified 
data spill occurs, Reference (br) requires that it is immediately: 


(1) Reported to the appropriate authorities, including, at a minimum, the OCA, the 
information owner/originator, the IAM, the activity security manager, and the responsible 
computer incident response center. 


(2) Isolated and contained to minimize damage and to preserve evidence that may be 
required for damage assessment, risk assessment, law enforcement, or CI purposes. All affected 
media is to be considered classified at the same level as the spilled information until the 
appropriate remediation processes have been executed and verified. 
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(3) Verified to be classified by the information owner, who shall also ensure an 
assessment is conducted, as appropriate, in accordance with References (d) and (f) and this 
Manual. 


d. CNSS Instruction 1001 (Reference (bs)) implements Reference (br) and provides a list of 
questions that should be asked when investigating a spill, potential options for remediating the 
effects of a spill, and factors to be considered in selecting a remediation procedure. 


e. Information concerning a classified spillage incident shall be protected from disclosure. 
Communications regarding the fact that a spill situation exists should be communicated to those 
involved, including the remediation teams, via secure communications whenever possible. The 
technical remediation teams must be cleared to the level of the information that may have been 
spilled. 


f. Decisions regarding mitigation procedures, including disposition of affected media (i.e., 
sanitization, physical removal, or destruction) shall realistically consider the potential harm that 
may result from compromise of spilled information. 


g. During a spill event, a speedy and coordinated response among security, IA, and other 
technical personnel is vital. Significant unauthorized or inadvertent dissemination of classified 
information on unclassified information systems can occur rapidly. 


(1) Once a spill is reported, the information system support organization must, whenever 
possible, quickly implement technical isolation of contaminated workstations, servers, and back- 
up systems to avoid spreading the contamination, to avoid loss of systems availability, and to 
minimize exposure of classified information to those individuals or organizations not authorized 
to receive it. At the same time, the security and IT staffs must begin the process of determining 
whether a security incident has actually occurred. If so, remediation procedures, which must be 
developed, approved, and tested in advance, should be implemented. 


(2) E-mail (whether in the body of the e-mail or attachment) is the most common method 
by which spills occur. The IA staff should have proven procedures to remediate up to Secret- 
level spills to portable computing devices. Remediation of Top Secret, SAP, and SCI spills to 
personal electronic devices (PED), however, may entail destruction of the hardware. 


(3) For Secret-level spills and below, the technical state of the art currently allows for 
overwriting and sanitization of contaminated media, and reentry of the media into service. There 
is no approved overwriting or sanitization procedure for media that has been contaminated with 
Top Secret, SAP, or SCI data, short of physical destruction. However, such media may continue 
to be used if (re)classified at the higher level, where appropriate. 


(4) Early identification of classified spills, and a thorough understanding of where the 
spilled data was sent, is essential to avoid widespread contamination (or re-contamination) of 
back-up servers, tape systems, and off-site storage locations, most of which are configured to run 
nightly or during periods of low usage. 
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h. Classified spills to a personally owned device should also be reported to security officials 
immediately so remediation can be undertaken as necessary to prevent further unauthorized 
disclosure. 


6. DISPOSAL OF COMPUTER MEDIA 


a. NSA/CSS publishes lists of products that meet specific performance criteria for sanitizing, 
destroying or disposing of various types of media containing sensitive or classified information. 
Among the products identified are those that can be used for erasure of magnetic storage devices 
(e.g., hard drives) and destruction of optical media (e.g., CDs and DVDs). The lists are available 
at http://www.nsa.gov/ia/guidance/media_destruction_guidance/index.shtml or by calling (410) 
854-6358. The NSA/CSS Storage Device Declassification Manual, available at that web 
address, addresses procedures required for sanitization, declassification and release of computer 
storage devices that have held classified information. Overwriting as a method of clearing 
previously classified data may be used when the media is reused within the same environment. 
Sections 17 and 18 of Enclosure 3 of this Volume provide additional guidance on destruction of 
classified information. 


b. When no longer needed, UNCLASSIFIED computer systems and hard drives may be 
disposed of outside the Department of Defense. In some circumstances, the equipment may be 
provided to non-government entities for reutilization. To ensure that no data or information 
remains on operable unclassified hard drives that are transferred or permanently removed from 
DoD custody, the drives must be sanitized by overwriting. Where overwriting is inappropriate or 
cannot be accomplished (e.g., inoperable disk) or the drives are to be totally removed from 
service (i.e., thrown away), the drives must be destroyed. The specific methods and procedures 
differ depending on sensitivity of data and ownership of the hard drive. To ensure DoD 
information is not inadvertently disclosed to unauthorized individuals, the activity security 
manager should coordinate with the local DAA and/or IT staff to ensure local procedures for 
disposal of computer hard drives appropriately address removal of U.S. Government data prior to 
disposal. (See Assistant Secretary of Defense for Command, Control, Communications and 
Intelligence Memorandum (Reference (bt)) for detailed guidance.) 


7. NON-TRADITIONAL WORK ENVIRONMENTS. Increasingly, a wide variety of sensitive 
and even classified activities are performed from non-traditional work environments, to include 
employee homes. In the historic context, this work has principally involved unclassified 
information and projects. However, classified IT (e.g., SIPRNET) systems and installations are 
increasingly being approved for utilization by senior personnel. When such is the case, in 
addition to the requirements of section 12 of Enclosure 2 of this Volume, the following minimum 
physical and administrative security criteria must be addressed: 


a. Physical site security survey/analysis. Where prudent, a crime survey may be requested 
from local authorities to facilitate understanding of risks associated with the site. 
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b. Employee training on classified information systems operation, as well as protection and 
storage of classified information and COMSEC materials. 


c. Provisions for secure storage and/or destruction of any classified information that may be 
required or generated (e.g. storage of COMSEC key materials, classified hard drives, and 
documents). 


d. Application of and compliance with requirements for security-in-depth. 


e. Written approval for such use of classified information and equipment. 


8. REQUIREMENT FOR ENCRYPTION OF CERTAIN UNCLASSIFIED DATA, In 
accordance with DoD policy, all unclassified DoD data that has not been approved for public 
release and is stored on mobile computing devices or removable storage media must be 
encrypted using commercially available encryption technology. This requirement includes all 
CUI as well as other unclassified information that has not been reviewed and approved for public 
release. See Assistant Secretary of Defense for Networks and Information Integration 
(ASD(NII)) Memorandum (Reference (bu)) for detailed guidance. 


9. PII 


a. PII, which is a type of CUI, must be protected from public disclosure in accordance with 
Federal policy, as described in ASD(NID) Memorandum (Reference (bv)) and Director, 
Administration and Management Memorandum (Reference (bw)). Some PII also qualifies for 
protection under the provisions of section 552a of Reference (bk) (also known and hereinafter 
referred to as “The Privacy Act of 1974, as amended”). Certain PII requires data-at-rest 
encryption and other protections. 


b. PII has protection and reporting requirements of which the activity security manager 
should be aware in the event the loss or unauthorized disclosure of PII (known as a “breach”’) is 
reported to the security office, separately or as part of an unauthorized disclosure of classified 
information. Although Privacy Act and/or IT officials are responsible for addressing a breach, 
activity security managers should be familiar with the protection and breach reporting 
requirements, the required timeframes for such reports, and the process identified in the DoD 
Component breach remediation plan for responding to breaches. A breach may trigger a chain of 
required actions, including notifications to the UsCYBERCOM, United States Computer 
Emergency Readiness Team, the DoD Component Head, and DoD Privacy Act officials. Breach 
reports must be unclassified. 


10. NEW TECHNOLOGY AND EQUIPMENT. Technology, in general, and IT technology 
specifically, changes much more quickly than information security policy. New products for 
data storage, communications, access control, and intrusion detection, and new IT equipment and 
peripherals (e.g., hand-held classified devices such as the Secure Mobile Environment PED 
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(commonly referred to as “SME PED”)) all have implications, and potential challenges, for 
information security. The security manager must remember that the fundamental principles upon 
which the information security program resides are still applicable and provide the foundation 
for dealing with new capabilities. The activity security manager must work with the IAM and 
the local DAA(s) to identify new risks and develop appropriate procedures to mitigate those 
risks. Where new policy or procedures are required to address new capabilities, suggested 
updates and/or issues should be forwarded through the security chain of command to the Director 
of Security, OUSD(I&S). 


11. INTERNET-BASED SOCIAL NETWORKING SERVICES. Use of Internet-based social 
networking services, such as Facebook, Twitter, YouTube, and MySpace, is governed by DoDI 
8170.01 (Reference (bx)). The policy addresses both official use of such capabilities and non- 
official use by DoD personnel. It also covers use of other publicly accessible information 
capabilities and applications available on the Internet (e.g., wikis, blogs) in locations not owned, 
operated, or controlled by the Department of Defense or the Federal Government. As each DoD 
Component is responsible for ensuring all uses of these services are compliant with information 
security, [A and OPSEC policies and procedures, officials from these disciplines need to 
coordinate efforts to implement appropriate training, procedures, and oversight. The 
requirements for protecting classified information and CUI from unauthorized disclosure are the 
same when using social networking services as when using other media and methods of 
dissemination and the penalties for ignoring the requirements are likewise the same. 


12. MARKING REQUIREMENTS FOR ELECTRONIC INFORMATION, Regardless of 
media, the requirement to identify as clearly as possible the information requiring protection 
remains. Where it is not feasible to include markings with all of the information required for 
classified documents, an explanatory statement that provides the required information shall be 
included on the item or with the documentation that accompanies it. 


a. For specific guidance on marking in an electronic environment, see section 17, Enclosure 
3 of Volume 2 of this Manual, as well as related information in section 16 (briefing slides) and 
paragraph 18.g (removable electronic storage media) of the same enclosure. 


b. The use of metadata and other electronic tags, as required by DoDI 8320.02 (Reference 
(by)), to identify the classification level, releasability, and other security attributes of electronic 
data files can facilitate automated application and enforcement of security measures. However, 
it is imperative that metadata and electronic tags associated with declassified or downgraded 
information in electronic format be reviewed and updated or deleted, as necessary, to reflect the 
actual classification and other attributes of the information. Precautions must be taken to ensure 
classified attributes are not released with unclassified data. 


13. PROCESSING REQUIREMENTS FOR SPECIFIC TYPES OF INFORMATION 


a. SCI. SCI, regardless of classification level, must be processed only on an information 
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system accredited for SCI processing (e.g., Joint Worldwide Intelligence Communications 
System (JWICS)). It may not be processed on, transferred to, or stored on SIPRNET, even if the 
information is SECRET//SI, SECRET//HCS, etc., as SIPRNET is not accredited for SCI. Any 
transfer to and/or processing of SCI on SIPRNET constitutes a data spillage from a higher to a 
lower-security information domain, in accordance with Reference (br). 


b. RD and Critical Nuclear Weapons Design Information (CNWDI). RD and CNWDI 


require certain access and dissemination controls, as specified by DoDI 5210.02 (Reference 
(bz)), beyond those for other information of a comparable level of security classification. 
Requirements for processing RD or CNWDI are specified in section 12, Enclosure 3 of Volume 
1 of this Manual. 


c. SAP. SAP information, regardless of classification, shall be processed only on an 
information system specifically accredited for SAP processing and operating at a classification 
level that meets or exceeds the classification level of the SAP data. 


d. Controlled Imagery. Information marked “IMCON” (controlled imagery) may not be 
processed on SIPRNET or posted to SIPRNET websites without prior approval from the 
National Geospatial-Intelligence Agency. See Appendix 2, Enclosure 4 of Volume 2 of this 
Manual. 


e. NATO Information. NATO information, regardless of classification, must be processed 
on U.S. government CLASSIFIED information systems operating at an appropriate level of 
classification with encrypted data transport and storage and specifically accredited for NATO 
processing, in accordance with the requirements of Reference (ab) and Deputy Secretary of 
Defense Memorandum (Reference (ca)). For further guidance on accreditation, handling and 
processing of NATO information, including how to handle data spills involving NATO 
information, contact the Central U.S. Registry. 


f. CUI. FOUO and other CUI may NOT be posted to publicly-accessible Internet sites and 
may NOT be posted to sites whose access is controlled only by domain (e.g., limited to .mil 
and/or .gov) as such restricted access can easily be circumvented. At a minimum, posting CUI to 
a website requires certificate-based (e.g., common access card) or password and ID access as 
well as encrypted transmission using hypertext transfer protocol secure (https) or similar 
technology. CUI other than FOUO may have additional posting restrictions. See Deputy 
Secretary of Defense Memorandum (Reference (cb)) for detailed guidance. 


14. COMPILATION AND DATA AGGREGATION. The ability to create large databases as 
well as nearly universal Internet posting of information makes use of search, data mining, and 
other data correlation tools convenient and easy. All of these capabilities facilitate creation of 
classified compilations of data. The security manager should consider the potential for creation 
of classified compilations when reviewing Internet postings, new IT systems, and security 
classification guides, and, as appropriate, when other classification assistance is requested. See 
Enclosure 4 of Volume 1 of this Manual, for guidance on classification by or as a result of 
compilation and Enclosure 6 of Volume 1 for considerations relative to Internet posting of data 
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AC 
ACCM 
AECS 
ASD(NII) 


AUS 


C&A 
CD 
CFR 

CI 
CJCSM 
CNSS 
CNWDI 
COMSEC 
CONUS 
CPI 
CUI 


DAA 
DC 
DCIO 
DCS 
DD 
DGR 
DMS 
DNI 
DoDD 
DoDI 
DoJ 
DSA 
DUSD(I&S) 
DVD 


E.O. 


FED-STD 
FGI 

FMS 
FOUO 
FRD 
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GLOSSARY 


PART I. ABBREVIATIONS AND ACRONYMS 


alternating current 

alternative compensatory control measures 

automated entry control systems 

Assistant Secretary of Defense for Networks and Information 
Integration 

Australia 


certification and accreditation 

compact disc 

Code of Federal Regulations 
counterintelligence 

Chairman of the Joint Chiefs of Staff Manual 
Committee on National Security Systems 
Critical Nuclear Weapon Design Information 
communication security 

continental United States 

critical program information 

controlled unclassified information 


designated approval authority 

direct current 

defense criminal investigative organization 
Defense Courier Service 

DoD 

designated government representative 
Defense Message System 

Director of National Intelligence 

DoD directive 

DoD instruction 

Department of Justice 

designated security authority 

Deputy Under Secretary of Defense for Intelligence and Security 
digital video disc (also digital versatile disc) 


Executive Order 


Federal Standard 

foreign government information 
foreign military sales 

For Official Use Only 

Formerly Restricted Data 
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GAO 
GC, DoD 
GPO 
GSA 


HUMINT 


IA 
IAM 
IAO 
ID 
IDE 
IDS 
ISCAP 
ISOO 
IT 


JPAS 
JWICS 


LOA 


NARA 
NATO 
NCIX 
NDA 
NOFORN 
NSA/CSS 
NTISSI 


OCA 
ODNI 
OUSD(I&S) 
OUSD(P) 


PCU 
PED 
PII 
PIN 
POE 


RD 
REL TO 
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Government Accountability Office 

General Counsel of the Department of Defense 
Government Printing Office 

General Services Administration 


human intelligence 


information assurance 

information assurance manager 

information assurance officer 

identification 

intrusion detection equipment 

intrusion detection system 

Interagency Security Classification Appeals Panel 
Information Security Oversight Office 
information technology 


Joint Personnel Adjudication System 
Joint Worldwide Intelligence Communications System 


letter of offer and acceptance 


National Archives and Records Administration 

North Atlantic Treaty Organization 

National Counterintelligence Executive 

non-disclosure agreement 

not releasable to foreign nationals 

National Security Agency/ Central Security Service 
National Telecommunications Information Systems Security 
Instruction 


original classification authority 

Office of the Director of National Intelligence 

Office of the Under Secretary of Defense for Intelligence and Security 
Office of the Under Secretary of Defense for Policy 


premise control unit 

personal electronic device 
personally identifiable information 
personal identification number 
port of embarkation 


Restricted Data 
authorized for release to 
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SAP Special Access Program 

SCI sensitive compartmented information 

SCIF sensitive compartmented information facility 
SF standard form 

SIPRNET Secret Internet Protocol Router Network 
SPECAT Special Category 

TSA Transportation Security Administration 
TSCM technical surveillance countermeasures 

UK United Kingdom 

UL Underwriters Laboratories 

U.S.C. United States Code 

USCYBERCOM U.S. Cyber Command 

USD(1I&S) Under Secretary of Defense for Intelligence and Security 
USD(P) Under Secretary of Defense for Policy 


PART II. DEFINITIONS 
Unless otherwise noted, these terms and their definitions are for the purpose of this Manual. 
access. The ability or opportunity to obtain knowledge of classified information. 
activity head. See “heads of DoD activities.” 


activity security manager. The individual specifically designated in writing and responsible for 
the activity’s information security program which ensures that classified information and CUI is 
properly handled during its entire life cycle. This includes ensuring it is appropriately identified, 
marked, stored, disseminated, disposed of, and accounted for, as well as providing guidance on 
the handling of security incidents to minimize adverse effects and ensure that appropriate 
corrective action is taken. The security manager may be assigned responsibilities in other 
security disciplines such as personnel and physical security, etc. 


agency. Any “Executive Agency” as defined in section 105 of Reference (bk); any “Military 
Department” as defined in section 102 of Reference (bk); and any other entity within the 
Executive Branch that comes into the possession of classified information. 

alarmed zone. The totality of area covered by a premise control unit and the sensors it serves. 
Australian Communities. The Australian Government entities with facilities and non- 


governmental facilities identified on the Department of State’s Directorate of Defense Trade 
Controls website (http://www.pmddtc.state.gov/treaties/index.html) at the time of export. 
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authentication. Those measures designed to establish the validity of attributes associated with 
some entity (e.g., user, process, or device), or a means of verifying an individual’s authorization 
to receive specific categories of information. Authentication is often accomplished as a 
prerequisite to allowing access to resources in an information system. 


authorized person. A person who has a favorable determination of eligibility for access to 
classified information, has signed a SF 312, and has a need to know for the specific classified 
information in the performance of official duties. 


automated information system. An assembly of computer hardware, software, or firmware 
configured to collect, create, communicate, compute, disseminate, process, store, or control data 
or information. 


automatic declassification. The declassification of information based solely upon: 


The occurrence of a specific date or event as determined by the OCA; or 


The expiration of a maximum time frame for duration of classification established pursuant 
to Reference (d). 


availability. Timely, reliable access to data and information services for authorized users. 


classification. The act or process by which information is determined to be classified 
information. 


classified national security information. Information that has been determined pursuant to 
Reference (d), or any predecessor order, to require protection against unauthorized disclosure 
and is marked to indicate its classified status when in documentary form. 


classifier. An individual who makes a classification determination and applies a security 
classification to information or material. A classifier may be an OCA or a person who 
derivatively assigned a security classification based on a properly classified source or a security 
classification guide. 


collateral information. All national security information classified Confidential, Secret, or Top 
Secret under the provisions of an E.O. for which special systems of compartmentation (such as 
SCI or SAP) are not formally required. 


COMSEC. The protection resulting from all measures designed to deny unauthorized persons 
information of value that might be derived from the possession and study of telecommunications 
and to ensure the authenticity of such communications. COMSEC includes crypto security, 
emission security, transmission security, and physical security of COMSEC material and 
information. 


compromise. An unauthorized disclosure of classified information. 
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confidentiality. Assurance that information is not disclosed to individuals, devices, processes, or 
other entities unless they have been authorized access to the information. 


CONUS. U.S. territory, including adjacent territorial waters, located within the North American 
content between Canada and Mexico. 


CPI. Defined in DoDI 5200.39 (Reference (cc)). 


DAA. The official with the authority to formally assume responsibility for operating a system at 
an acceptable level of risk. This term is synonymous with designated accrediting authority and 
delegated accrediting authority. 


damage assessment. A formal multi-disciplinary analysis to determine the effect of a 
compromise of classified information on the national security 


damage to the national security. Harm to the national defense or foreign relations of the United 
States from the unauthorized disclosure of information, taking into consideration such aspects of 
the information as the sensitivity, value, utility, and provenance of that information. 


declassification. The authorized change in the status of information from classified information 
to unclassified information. 


declassification authority. The official who authorized the original classification, if that official 
is still serving in the same position; 


The originator’s current successor in function; 
A supervisory official of either; or 


Officials delegated declassification authority in writing by the agency head or the senior 
agency official. 


declassification guide. Written instructions issued by a declassification authority that describes 
the elements of information regarding a specific subject that may be declassified and the 
elements that must remain classified. Also a guide providing classification and declassification 
instructions specifically for information that is 25 years old or older and of permanent historical 
value. A declassification guide is the most commonly used vehicle for obtaining ISCAP 
approval of 25-year exemptions from the automatic declassification provisions of Reference (d). 


defense articles. For purposes of the Defense Trade Cooperation Treaty between the United 
States and Australia or the United Kingdom, those articles, services, and related technical data, 
including software, in tangible or intangible form, listed on the United States Munitions List of 
Reference (x). Defense articles exempt from the scope of section 126.17 of Reference (x) are 
identified in Supplement No. 1 to Part 126 of Reference (x). 
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derivative classification. Incorporating, paraphrasing, restating, or generating in new form 
information that is already classified, and marking the newly developed material consistent with 
the classification markings that apply to the source information. Includes the classification of 
information based on classification guidance. The duplication or reproduction of existing 
classified information is not derivative classification 


distribution statement. A statement used on a technical document to denote the extent of its 
availability for secondary distribution, release, and disclosure without additional approvals or 
authorizations. A distribution statement marking is distinct from and in addition to a security 
classification marking. A distribution statement is also required on security classification guides 
submitted to DTIC. 


document. Any recorded information, regardless of the nature of the medium or the method or 
circumstances of recording. This includes any physical medium in or on which information is 
recorded or stored, to include written or printed matter, audiovisual materials, and 
electromagnetic storage media. 


downgrading. A determination by a declassification authority that information classified and 
safeguarded at a specified level shall be classified and safeguarded at a lower level. 


escort. A cleared individual who accompanies a shipment of classified material to its 
destination. The classified material does not remain in the personal possession of the escort, but 
the conveyance in which the material is transported remains under the constant observation and 
control of the escort. 


espionage. Those activities designed to obtain, deliver, communicate, or transmit information 
relating to the national defense with the intent or reason to believe such information will be used 
to the injury of the United States or to the advantage of a foreign nation or transnational entity. 


exempted. Nomenclature and marking indicating information has been determined to fall within 
an enumerated exemption from automatic declassification in accordance with Reference (d). 


FGI 


Information provided to the U.S. Government by a foreign government or governments, an 
international organization of governments, or any element thereof, with the expectation that the 
information, the source of the information, or both, are to be held in confidence. 


Information produced by the U.S. Government pursuant to or as a result of a joint 
arrangement with a foreign government or governments, or an international organization of 
governments, or any element thereof, requiring that the information, the arrangement, or both, 
are to held in confidence. 


Information received and treated as “Foreign Government Information” pursuant to the terms 
of a predecessor order to Reference (d). 
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FRD. Information removed from the Restricted Data category upon a joint determination by the 
Department of Energy (or antecedent agencies) and the Department of Defense that such 
information relates primarily to the military utilization of atomic weapons and that such 
information can be safeguarded adequately as classified defense information. For purposes of 
foreign dissemination, this information is treated in the same manner as Restricted Data. 


FOUO. A protective marking to be applied to unclassified information when disclosure to the 
public of that particular record, or portion thereof, would reasonably be expected to cause a 
foreseeable harm to an interest protected by one or more provisions of the FOIA. This includes 
information that qualifies for protection pursuant to the provisions of the Privacy Act of 1974, as 
amended. See DoDD 5400.07 (Reference (cd)) for detailed information on categories of 
information that may qualify for exemption from public disclosure. 


heads of DoD activities. Heads, either military or civilian, of organizations, commands, and staff 
elements subordinate to a DoD Component, with jurisdiction over and responsibility for the 
execution of the organization’s mission and functions, including its information security 
program. The official may variously carry the title of commander, commanding officer, or 
director, or other equivalent title. 


homeland. The physical region that includes the continental United States, Alaska, Hawaii, 
United States possessions and territories, and surrounding territorial waters and airspace. 


IAM. The individual responsible for the IA program of a DoD information system or 
organization. While the term IAM is favored within the Department of Defense, it may be used 
interchangeably with the title information systems security manager. 


IAO. An individual responsible to the IAM for ensuring that the appropriate operational IA 
posture is maintained for a DoD information system or organization. While the term IAO is 
favored within the Department of Defense, other titles also are used (e.g., information systems 
security officer, information systems security custodian, network security officer, or terminal 
area security officer). 


information. Any knowledge that can be communicated or documentary material, regardless of 
its physical form or characteristics, that is owned by, produced by or for, or is under the control 
of the U.S. Government. 


information security. The system of policies, procedures, and requirements established in 
accordance with Reference (d) to protect information that, if subjected to unauthorized 
disclosure, could reasonably be expected to cause damage to national security. The term also 
applies to policies, procedures and requirements established to protect controlled unclassified 
information, which may be withheld from release to the public in accordance with statute, 
regulation, or policy. 


infraction. Any knowing, willful, or negligent action contrary to the requirements of Reference 


(d), its implementing directives, or this Manual that does not constitute a “violation,” as defined 
herein. 
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inguiry. The initial fact-finding and analysis process to determine the facts of any security 
incident. 


integrity. The state that exists when information is unchanged from its source and has not been 
accidentally or intentionally modified, altered, or destroyed. Integrity in the IA environment 
addresses the logical correctness, completeness, and reliability of the operating system, and the 
system hardware, software and data. In a formal security mode, integrity is interpreted more 
narrowly to mean protection against unauthorized modification or destruction of data or 
information. 


Intelligence Community. An element or agency of the U.S. Government identified in or 
designated pursuant to section 3(4) of the National Security Act of 1947, as amended (Reference 
(ce)), or section 3.5(h) of E.O. 12333 (Reference (cf)). 


international program. Any program, project, contract, operation, exercise, training, experiment, 
or other initiative that involves a DoD Component or a DoD contractor and a foreign 
government, international organization, or corporation that is located and incorporated to do 
business in a foreign country. 


investigation. An in-depth, comprehensive examination of the facts associated with a security 
violation. 


loss. The inability to physically locate or account for classified information. 
material. Any product or substance on or in which information is embodied. 


metadata. Structured information that describes, explains or locates data or otherwise makes 
data easier to retrieve, use or manage. Metadata captures or specifies basic attributes and 
characteristics about information and is often referred to as information about information. 
Typical metadata in an electronic environment includes such attributes as author, creation date, 
file size, and storage location. Security metadata may include attributes such as classification 
level, OCA, and date for declassification. 


national security. The national defense or foreign relations of the United States. National 
security includes defense against transnational terrorism. 


need to know. A determination made by an authorized holder of classified information that a 
prospective recipient requires access to specific classified information in order to perform or 
assist in a lawful and authorized governmental function. 

network. A system of two or more computers that can exchange data or information. 
nickname. A nickname is a combination of two separate unclassified words that is assigned an 


unclassified meaning and is employed only for unclassified administrative, morale, or public 
information purposes. 
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non-repudiation. The condition where the sender of data is provided with proof of delivery and 
the recipient is provided with proof of the sender's identity, so neither can later deny having 
processed the data. 


open storage area. An area constructed in accordance with the requirements of the Appendix to 
Enclosure 3 of this Volume and authorized by the senior agency official for open storage of 
classified information. 


original classification. An initial determination that information requires, in the interests of 
national security, protection against unauthorized disclosure. 


OCA. An individual authorized in writing, either by the President, the Vice President, or by 
agency heads or other officials designated by the President, to originally classify information 
(i.e., to classify information in the first instance). 


permanent historical value. Having sufficient value to warrant being maintained and preserved 
permanently. 


PII. Unique information about an individual that can be used to distinguish or trace his or her 
identity. It includes, but is not limited to, name, social security number, date and place of birth, 
mother's maiden name, home address and phone number, personal e-mail address, biometric 
records, financial transactions, medical history, criminal or employment history, and other 
information to which a security manager may have access. PII does not include an individual’s 
name when it is associated with work elements, such as duty phone number, duty address, and 
U.S. Government e-mail address. 


protective security service. Defined in Reference (az). 


public media. A medium of communications designed to reach the public. Public media 
includes print media (e.g., newspapers, magazines, books), broadcast media (e.g., radio, 
television) and Internet media (e.g., websites, blogs, tweets). 


records. The records of an agency and Presidential papers or Presidential records, as those terms 
are defined in chapters 22 and 33 of Reference (t), including those created or maintained by a 
U.S. Government contractor, licensee, certificate holder, or grantee that are subject to the 
sponsoring agency’s control under the terms of the contract, license, certificate, or grant. 


records management. The planning, controlling, directing, organizing, training, promoting, and 
other managerial activities involved with respect to records creation, records maintenance and 
use, and records disposition in order to achieve adequate and proper documentation of the 
policies and transactions of the Federal Government and effective and economical management 
of agency operations. Within the Department of Defense, records management is implemented 
by Reference (u). 
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RD. All data concerning design, manufacture, or utilization of atomic weapons; the production 
of special nuclear material; or the use of special nuclear material in the production of energy, but 
not data declassified or removed from the Restricted Data category pursuant to section 2162 of 
The Atomic Energy Act of 1954, as amended (Reference (ch)). 


safeguarding. Measures and controls that are prescribed to protect classified information. 


SAP. A program established for a specific class of classified information that imposes 
safeguarding and access requirements that exceed those normally required for information at the 
same Classification level. In the Department of Defense, any DoD program or activity (as 
authorized in Reference (d)), employing enhanced security measures (e.g., safeguarding, access 
requirements, etc.), exceeding those normally required for collateral information at the same 
level of classification, shall be established, approved, and managed as a DoD SAP in accordance 
with Reference (ag). 


SCI. Classified information concerning or derived from intelligence sources, methods, or 
analytical processes that is required to be handled within formal access control systems 
established by the Director of National Intelligence. 


secure room. An open storage area. 
security classification guide. A documentary form of classification guidance issued by an OCA 


that identifies the elements of information regarding a specific subject that must be classified and 
establishes the level and duration of classification for each such element. 


security clearance. A determination that a person is eligible in accordance with the standards of 
Reference (1) for access to classified information. 


security-in-depth. A determination by the senior agency official that a facility's security program 
consists of layered and complementary security controls sufficient to deter and detect 
unauthorized entry and movement within the facility. Examples include, but are not limited to, 
use of perimeter fences, employee and visitor access controls, use of an IDS, random guard 
patrols throughout the facility during non-working hours, closed circuit video monitoring or 
other safeguards that mitigate the vulnerability of open storage areas without alarms and security 
containers during non-working hours. 


self-inspection. The internal review and evaluation of individual DoD Component activities and 
the DoD Component as a whole with respect to the implementation of the program established in 
accordance with References (b), (d), and (f), and this Manual. 


senior agency official. An official appointed by the Head of a DoD Component to be responsible 
for direction, administration, and oversight of the Component’s Information Security Program, to 
include classification, declassification, safeguarding, and security education and training 
programs, and for the efficient and effective implementation of References (b), (d), (e), and (f) 
and the guidance in this Manual. Where used in reference to authorities under section 5.4(d) of 
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Reference (d), this term applies only to the Senior Agency Officials of the Military Departments 
and of the Department of Defense. 


telecommunications. The preparation, transmission, or communication of information by 
electronic means. 


unauthorized disclosure. Communication or physical transfer of classified or controlled 
unclassified information to an unauthorized recipient. 


United Kingdom Communities. The UK Government entities with facilities and non- 
governmental facilities identified on the Department of State’s Directorate of Defense Trade 
Controls website (http://www.pmddtc.state.gov/treaties/index.html) at the time of export. 


United States and its territories. The 50 states, the District of Columbia, Puerto Rico, Guam, 
American Samoa, the United States Virgin Islands, Wake Island, Johnston Atoll, Kingman Reef, 
Palmyra Atoll, Baker Island, Howland Island, Jarvis Island, Midway Islands, Navassa Island, and 
Northern Mariana Islands. 


vault. An area approved by the Head of the DoD Component which is designed and constructed 
of masonry units or steel lined construction to provide protection against forced entry and which 
is equipped with a GSA-approved vault door and lock. A modular vault approved by the GSA 
may be used in lieu of a vault. 


violation. Any knowing, willful, or negligent action that could reasonably be expected to result 
in an unauthorized disclosure of classified information; or 


Any knowing, willful, or negligent action to classify or continue the classification of 
information contrary to the requirements of Reference (d), its implementing directives, or this 


Manual; or 


Any knowing, willful, or negligent action to create or continue a special access program 
contrary to the requirements of Reference (d), Reference (ag), or this Manual. 


Change 3, 07/28/2020 123 GLOSSARY 


193 


Á aust 
titi SECURITY 


Expert Backgrounder: Secret 
Evidence in Public Trials 


Protecting defendants and national Security under the Classified 
ocedures Act (CIPA 


by David Aaron ‘The Espionage Act is getting star billing this year. From an HBO movie about an old case to a ‘Signups for AM. & PM. Emails 
newly charged case alleging a major leak of classified information to special counsel 


of O search author: 


COCO A aber Presidentani the curent President the only tling nrising iza 
-s new Law & Order spinoff. As Espionage Act cases develop 
iblic view, the American audience should understs 


move toward the cent 


d how these unusual prosecutions 


work. Critically, even though these cases involve the U.S. Intelligence Community, classified 
information, and government activities that are cloaked in secrecy, nothing changes the ———— 


basic premise that the United States affords criminal defendants due process and the right to Featured Articles 
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The National Security Dilemma 


Using classified information in a prosecution can cause damage to national security, because 


any exposure of classified information can reveal sensitive intelligence sources and methods. c 
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areas of law. Intelligence agencies are similar in this regard to a private victim — for + Oybersecu 
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In an Espionage Act case in particular, prosecutors and stakeholders in the U.S. Intelligence + Human 

Community must decide which documents to use as evidence, Prosecutors want to use 
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judges to accept Executive Branch decisions about what information must b 


haw to protect it. And it does not change the substantive laws of evidence or discovery. 


Rather, CIPA helps the government predict the risks that trying a national security case will 


expose classified information to the public, which in turn could cause further harm. CIPA ee 
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Litigation and decisions on these points all occur early on in a case. This avoids surprises in iii 


the course of a prosecution. It also provides the government with the opportunity to 


immediately appeal adverse rulings. Ultimately, if judges rule that fairness to a defendant Its Time to Establish a Syria 
requires the government to disclose classified information that the government seeks to apasa 


protect, the government can dismiss or modify the charge to reduce or eliminate its p 


disclosure obligation before the proceedings con 


inue. In other words, a judge does not have 


to grant the government's requests to protect classified information, but the government can 


always take its ball and go home 
Purpose of CIPA 


CIPA was enacted in 1980, about three years after Congress began a study of unauthorized 
disclosures of classified information. As the Senate Judiciary Committee recounted, that 


idy found that “prosecution of a defendant for disclosing national security information 
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it becomes to enforce the laws that 


uard our national security,” because in an Espionage 


case “the government often must choose between disclosing classified information or letting 
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of defendants to threaten disclosure of classified information in the course of trial and 


thereby constrain the government's ability to prosecute cases involving classified 
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1. As the Committee described it, however, “graymail” is not “limited to instances 


of unscrupulous or questionable conduct by defendants.” Rather, 
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and present a defense can pose the same risk of disclosing classified information 
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following framework to guide courts in making step-by-step assessments. 


First Steps 


CIPA itself provides a step-by-step process for the parties and the court to follow. First, CIPA 
Section 1 defines “classified information” as material that the U.S. government has 
determined requires protection against unauthorized disclosure for national security 
reasons. CIPA therefore covers information classified under Executive Order 13526 and 
Restricted Data” as defined in the Atomic Energy Act based on the government's prior 
decision that the information meets national security-based standards for protection. Those 


standards are ni 
at has been produced by or for the government and 
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bitrary. The government can only classify national security information 
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hat relates to at least one of si 
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degree of damage that unauthor 


to cause. A “Top Secret” classification corresponds to “exceptionally grave damage.” “Secret” 
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Whether to classify information is an Ex 
whether information is classified. 


utive Branch decision. Courts do not decide 


Pros perally commence CIPA proceedings by moving for a pretrial conference under 
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CIPA Section 2. Most judges have not presided over cases that involve classified information 


and may not be familiar with national security information, protecting intelligence sources 


d methods, and the sometimes arcane and cumbersome processes the government uses to 


such information secure. CIPA Section 2 motions therefore often include a preview of 
the stages of CIPA. See, eg., United States v. Reality Winner, No. 1:17-cr-34, ECE No. 30 (S. 
Ga. June 19, 2017); United States v. Harold T. Martin II], No. 1:17-cr-69, ECF No. 41 (March 6, 
2017). This allows the court to set a schedule that provides sufficient time to litigate each 
stage and anticipate case-specific issues that may aris 


Ina CIPA Section 2 motion, prosecutors also move for the appointment of a Classified 
Information Security Officer (CISO). At Section 9, CIPA directs the Chief Justice of the U.S. 
Supreme Court to prescribe rules for protecting classified information in the course of 
litigation, and those procedures direct judges to designate a CISO from the Department of 
Justice (DOJ) Litigation Security Group. Although CISOs are DOJ employees, when they 
support classified litigation they are ution team and s 
capacity” on behalf of the court. For exan 
classified information, initiate the security clearance process for defense counsel and court 
staff, provide secure spaces for storing and processing classified information, and advise the 
court on security procedures. 


ve “ina neutral 


e the movement and storage of 


Next, if prosecuta 
move under CIPA Section 3 for a protective order that prohibits disclosure of any classified 


anticipate providing classified information to the defense team, they 


information that the government produces. Protective orders are routinely used in court 
s to protect privacy 
information. CIPA provides that the court “shall” issue such an order upon the gi 
. The process of obtaining a Section 3 protective order is usually as straightforward as 
y other protective order, such as those commonly issued in relation to discovery 
and subpoenaed material, but defense counsel sometimes push back, as the def 
the Winner case did. After back-and-forth briefing, the court in Winner found that the 
government's proposed protective order did “not preclude the defense fre 


ade secrets, informants’ identities, and oth 


ensitive 
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vernment’s 


motior 


obtaining a 


e team in 


ising classified 
information” in the case, but rather “merely require[d] the defense to comply” with “standard 


procedures for protecting classified information in the context of criminal cases.” 
Discovery 


Section 4 is generally where CIPA litigation begins to get contentious. This provision 
provides the framework for the court's decisions regarding discovery. The same principles 
and obligations that govern discovery in any other criminal case apply in a national security 
prosecution. In an Espionage Act case, the core evidence against the defendant-the national 
defense information that the defendant stole, retained, or disclosed-_is likely to be classified. 
CIPA Section 10 explicitly requires prosecutors to notify a defendant of the material on 
Which it intends to rely in proving elements that involve national defense or classified 
information. Other evidence that shows the defendant's actions or communications may also 
be classified because of how it was obtained. Still other classified information may be 
discoverable even if the government does not intend to use it as affirmative evidence — the 
same obligations to disclose exculpatory material, prior statements of witnesses, and other 
categories of information remain unchanged. Accordingly, DOJ policy, specifically Section 9- 
20.210 of the Justice Manual, directs prosecutors to seek out and review classified 
information at other agencies to determine whether any such information is potentially 
discoverable. After prosecutors assess their discovery obligations as to classified information, 
they may move to protect it. 


At the discovery stage, prosecutors have three potential options. They may move to: 


1. “delete” specific classified information from discovery; 
2. substitute a summary of the information a classified document contains instead of 

producing the document itsel 
3. stipulate to relevant facts that the classified information would intend to prove. 


“Deletion” usually consists of redacting portions of a document, but can also entail 
withholding a document in its entirety. The government may also move to provide classified 
discovery to counsel only, and not the defendant, although that issue arises more often in 
terrorism cases than in Espionage Act cases because Espionage Act defendants generally 
have already had access to the classified information at issue. The government, of course, 
cannot use any of these protective measures unilaterally. Rather, the court has the discretion 
to authorize prosecutors to take these steps “upon a sufficient showing.” CIPA allows the 
court to permit prosecutors to make ex parte submissions — ie., submissions that the defense 
does not see —to explain why each item of classified information requires the type of 
protection requested. 


‘The use of ex parte proceedings is not unique to CIPA and makes sense. After all, the entire 
purpose of an application to protect classified information, an informant’s identity or 
address, or other sensitive information from disclosure to a defendant would be undermined 
if the defendant received prosecutors’ submissions. It is not unusual for courts to permit 
defendants to submit their own ex parte submissions, for example to describe defense 
theories in order to help the court assess the relevance to the defense of the information the 
government seeks to protect. In this manner, the court ensures that the defendant receives 
information that discovery principles require the government to disclose, but limits 
discovery of classified information to material that is necessary to a fair proceeding. 


Significantly, CIPA does not provide the substantive law for the court to apply. That derives 
from Rule 16(d) of the Federal Rules of Criminal Procedure and associated case law. Rule 
16d), which applies in every federal criminal case, authorizes a court to “deny, restrict, or 
defer discovery or inspection, or grant other appropriate relief,” by good cause shown, 
Similar to CIPA Section 4, Rule 16(d) allows a party to argue ex parte in support of protecting 
information from disclosure. There are limits to this authority. Under a doctrine adopted in 
United States v. Yunis from criminal cases such as Raviaro v. United States, which involved 
protecting the identity of confidential informants for safety reasons, a court will examine 
whether the information the government seeks to protect is “relevant to the determination 
of... guilt or innocence,” “helpful to the defense,” and “essential to a fair determination of 
the cause." Ifthe court finds that withholding a particular classified document would deprive 
the defendant of due process, prosecutors can seek the court's approval of @ summary or 
admission of the relevant information to provide instead of the document itself. 


Prosecutors’ determinations that particular classified information will be discoverable, 
paired with their assessments of the likelihood that a court will apply requested protections 
in discovery, is an important factor in discussions with the U.S. Intelligence community 
elements that control the classified information at issue. Prosecutors cannot use or disclose 
that information without the originating agencies’ approval, and the originating agencies are 
not obligated to grant that permission. Discussions about the agencies’ willingness to allow 
disclosure are often spirited and can take some time. In the end, if agencies refuse to permit 
disclosure of specific information to the defense team, despite the fact that the defense team 
will have received security clearances and will be required to keep the information in an 
approved secure location, prosecutors will not be able to fulfill their legal and ethical 
obligations in discovery—most significantly, exculpatory information that prosecutors must 
disclose under Brady v. Maryland — if they proceed. As a result, if agencies withhold 
permission, prosecutors must dismiss or modify their case to render that information non- 
discoverable, if possible. 


‘These same analyses will apply to the use of classified information at trial, discussed below. 
In that context, the stakes are higher, because the default is that evidence will be disclosed to 
the public. 


Defendant's Obligations 


CIPA also imposes obligations on the defense team. If a defendant expects to either 
introduce classified information in a proceeding or otherwise cause its disclosure, Section 5 
requires the defendant to provide notice to prosecutors. Defendants may not disclose or 
cause disclosure of any classified information in connection with the prosecution without 
providing notice first. Section 5 authorizes the court to preclude disclosure if the defendant 
does not give notice. 


‘The purpose of the notice requirement is to facilitate pretrial litigation of the admissibility 
of classified information, Accordingly, the notice must be sufficiently specific to allow 
prosecutors to make informed arguments. Debates over the sufficiency of notice can be 
protracted. Defense teams resist disclosing details of their anticipated evidence for 
Constitutional reasons and to protect their trial strategies. It is well settled, however, that 
the Section 5 notice requirement does not violate the Fifth or Sixth Amendment and is 
reasonable in light of the need to safeguard classified information. 


Pretrial Determination of Admissibility 


In an ordinary criminal case, the court may rule on the admissibility of evidence during trial. 
Under CIPA Section (a), the court resolves questions of admissibility in advance of trial or 
any pretrial proceeding. Particularly as to classified information the defense anticipates 
disclosing, this provides the government with the opportunity to object and obtain rulings 
before the information is exposed, an opportunity to appeal adverse rulings early in the 
proceedings, and, if necessary to protect classified information, dismiss or modify its case 
rather than permit disclosure, 


CIPA does not change the rules of evidence. Admissibility decisions under CIPA Section 6(a) 
are governed by the same principles that govern evidence in any other prosecution. 
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information. CIPA provides that the court “shall” issue such an order upon the gi 
. The process of obtaining a Section 3 protective order is usually as straightforward as 
y other protective order, such as those commonly issued in relation to discovery 
and subpoenaed material, but defense counsel sometimes push back, as the def 
the Winner case did. After back-and-forth briefing, the court in Winner found that the 
government's proposed protective order did “not preclude the defense fre 


ade secrets, informants’ identities, and oth 
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vernment’s 
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e team in 


ising classified 
information” in the case, but rather “merely require[d] the defense to comply” with “standard 


procedures for protecting classified information in the context of criminal cases.” 
Discovery 


Section 4 is generally where CIPA litigation begins to get contentious. This provision 
provides the framework for the court's decisions regarding discovery. The same principles 
and obligations that govern discovery in any other criminal case apply in a national security 
prosecution. In an Espionage Act case, the core evidence against the defendant-the national 
defense information that the defendant stole, retained, or disclosed-_is likely to be classified. 
CIPA Section 10 explicitly requires prosecutors to notify a defendant of the material on 
Which it intends to rely in proving elements that involve national defense or classified 
information. Other evidence that shows the defendant's actions or communications may also 
be classified because of how it was obtained. Still other classified information may be 
discoverable even if the government does not intend to use it as affirmative evidence — the 
same obligations to disclose exculpatory material, prior statements of witnesses, and other 
categories of information remain unchanged. Accordingly, DOJ policy, specifically Section 9- 
20.210 of the Justice Manual, directs prosecutors to seek out and review classified 
information at other agencies to determine whether any such information is potentially 
discoverable. After prosecutors assess their discovery obligations as to classified information, 
they may move to protect it. 


At the discovery stage, prosecutors have three potential options. They may move to: 


1. “delete” specific classified information from discovery; 

2. substitute a summary of the information a classified document contains instead of 
producing the document itself; or 

3. stipulate to relevant facts that the classified information would intend to prove. 


“Deletion” usually consists of redacting portions of a document, but can also entail 
withholding a document in its entirety. The government may also move to provide classified 
discovery to counsel only, and not the defendant, although that issue arises more often in 
terrorism cases than in Espionage Act cases because Espionage Act defendants generally 
have already had access to the classified information at issue. The government, of course, 
cannot use any of these protective measures unilaterally. Rather, the court has the discretion 
to authorize prosecutors to take these steps “upon a sufficient showing.” CIPA allows the 
court to permit prosecutors to make ex parte submissions — ie., submissions that the defense 
does not see —to explain why each item of classified information requires the type of 
protection requested. 


‘The use of ex parte proceedings is not unique to CIPA and makes sense. After all, the entire 
purpose of an application to protect classified information, an informant’s identity or 
address, or other sensitive information from disclosure to a defendant would be undermined 
if the defendant received prosecutors’ submissions. It is not unusual for courts to permit 
defendants to submit their own ex parte submissions, for example to describe defense 
theories in order to help the court assess the relevance to the defense of the information the 
government seeks to protect. In this manner, the court ensures that the defendant receives 
information that discovery principles require the government to disclose, but limits 
discovery of classified information to material that is necessary to a fair proceeding. 


Significantly, CIPA does not provide the substantive law for the court to apply. That derives 
from Rule 16(d) of the Federal Rules of Criminal Procedure and associated case law. Rule 
16d), which applies in every federal criminal case, authorizes a court to “deny, restrict, or 
defer discovery or inspection, or grant other appropriate relief,” by good cause shown, 
Similar to CIPA Section 4, Rule 16(d) allows a party to argue ex parte in support of protecting 
information from disclosure. There are limits to this authority. Under a doctrine adopted in 
United States v. Yunis from criminal cases such as Raviaro v. United States, which involved 
protecting the identity of confidential informants for safety reasons, a court will examine 
whether the information the government seeks to protect is “relevant to the determination 
of... guilt or innocence,” “helpful to the defense,” and “essential to a fair determination of 
the cause." Ifthe court finds that withholding a particular classified document would deprive 
the defendant of due process, prosecutors can seek the court's approval of @ summary or 
admission of the relevant information to provide instead of the document itself. 


Prosecutors’ determinations that particular classified information will be discoverable, 
paired with their assessments of the likelihood that a court will apply requested protections 
in discovery, is an important factor in discussions with the U.S. Intelligence community 
elements that control the classified information at issue. Prosecutors cannot use or disclose 
that information without the originating agencies’ approval, and the originating agencies are 
not obligated to grant that permission. Discussions about the agencies’ willingness to allow 
disclosure are often spirited and can take some time. In the end, if agencies refuse to permit 
disclosure of specific information to the defense team, despite the fact that the defense team 
will have received security clearances and will be required to keep the information in an 
approved secure location, prosecutors will not be able to fulfill their legal and ethical 
obligations in discovery—most significantly, exculpatory information that prosecutors must 
disclose under Brady v. Maryland — if they proceed. As a result, if agencies withhold 
permission, prosecutors must dismiss or modify their case to render that information non- 
discoverable, if possible. 


‘These same analyses will apply to the use of classified information at trial, discussed below. 
In that context, the stakes are higher, because the default is that evidence will be disclosed to 
the public. 


Defendant's Obligations 


CIPA also imposes obligations on the defense team. If a defendant expects to either 
introduce classified information in a proceeding or otherwise cause its disclosure, Section 5 
requires the defendant to provide notice to prosecutors. Defendants may not disclose or 
cause disclosure of any classified information in connection with the prosecution without 
providing notice first. Section 5 authorizes the court to preclude disclosure if the defendant 
does not give notice. 


‘The purpose of the notice requirement is to facilitate pretrial litigation of the admiss 
of classified information, Accordingly, the notice must be sufficiently specific to allow 
prosecutors to make informed arguments. Debates over the sufficiency of notice can be 
protracted. Defense teams resist disclosing details of their anticipated evidence for 
Constitutional reasons and to protect their trial strategies. It is well settled, however, that 
the Section 5 notice requirement does not violate the Fifth or Sixth Amendment and is 
reasonable in light of the need to safeguard classified information. 


lity 


Pretrial Determination of Admissibility 


In an ordinary criminal case, the court may rule on the admissibility of evidence during trial. 
Under CIPA Section (a), the court resolves questions of admissibility in advance of trial or 
any pretrial proceeding. Particularly as to classified information the defense anticipates 
disclosing, this provides the government with the opportunity to object and obtain rulings 
before the information is exposed, an opportunity to appeal adverse rulings early in the 
proceedings, and, if necessary to protect classified information, dismiss or modify its case 
rather than permit disclosure, 


CIPA does not change the rules of evidence. Admissibility decisions under CIPA Section 6(a) 
are governed by the same principles that govern evidence in any other prosecution. 
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Protecting defendants and national Security under the Classified 
ocedures Act (CIPA 


by David Aaron ‘The Espionage Act is getting star billing this year. From an HBO movie about an old case to a ‘Signups for AM. & PM. Emails 
newly charged case alleging a major leak of classified information to special counsel 


of O search author: 


COCO A aber Presidentani the curent President the only tling nrising iza 
-s new Law & Order spinoff. As Espionage Act cases develop 
iblic view, the American audience should understs 


move toward the cent 


d how these unusual prosecutions 


work. Critically, even though these cases involve the U.S. Intelligence Community, classified 
information, and government activities that are cloaked in secrecy, nothing changes the ———— 


basic premise that the United States affords criminal defendants due process and the right to Featured Articles 


Filed under: 


defend themselves. In a national security prosecution, the secret world of intelligence 
information confronts the necessarily public world of trials, evidence, confrontation, and The Machine Got it Wrong? 

" Uncertainties, Assumptions, and 
rigorous protection of Constitutional rights. Constitutional rights prevail, of course. But if Biases 
the trial proceeds without adequate safeguar 
prosecution could disclose the very information the government seeks to keep secret 


s for classified information, a national security by arthur 


Key Takeaways from Biden 

The Classified Information Procedures Act, 18 U.S. 1. CIPA, protects both national ‘Aaieemsteation Raport an Feraal 
je Classified Information Procedures Act, 18 U.S.C. App. III, or CIPA, protects both nation: eeina 

security and due process and maintains checks and balances between the Executive and by ohn Remming 


Judicial branches of government. Over decades, the framework has been tested many times ay ad 
with success. 
Amid Russia's Aggression 
‘Towards Ukraine, Can Religious 
T have written elsewhere about some of the lesser-known substantive components of proving Freedom Endure? 


a violation of one of the most commonly charged violations of the Espionage Act, 18 U.S.C. § 
793(e), which 


rohibits unauthorized retention and disclosur 


of information relating to the 


national defense, also referred to as “national defense information” or NDI. By all Tho Dartur Genocide Demande 
International Action an 
indications, the American public should expect to learn more about that statute in the ecountabity 


coming weeks and months. But itis at least as important to understand the unique 


procedural aspects of a criminal prosecution that involves the Espionage Act (or similar 
federal offenses) that involves classified discovery or evidence. CIPA is often the proced: eee een 


heart of such prosecutions Key Topics 


The National Security Dilemma 


Using classified information in a prosecution can cause damage to national security, because 


any exposure of classified information can reveal sensitive intelligence sources and methods. c 


These kinds of concerns, and procedural safeguards to address them, are familiar to other č 
areas of law. Intelligence agencies are similar in this regard to a private victim — for + Oybersecu 
example, a company that suffers ts can be protected from having those + Demoo 


eft of trade sect 


trade secrets publicized in a prosecution of the thief +0 
+ Disinformation 

In an Espionage Act case in particular, prosecutors and stakeholders in the U.S. Intelligence + Human 

Community must decide which documents to use as evidence, Prosecutors want to use 

documents with jury appeal. If documents are highly classified and relate directly to an easy re 

to-understand national security issue, prosecutors will not have to take a judge or jury 

through a potentially complicated, technical explanation of why the compromise of those Resources 

documents even matters. Intelligence agencies, on the other hand, want prosecutors to use TRACKERS 


e the additional dan 


the least sensitive documents possible to mini 
Together, prosecutors and intelligence agencies often agree on “Goldilocks 
documents” that are sensitive enough, but not too sensitive, and not too arcane. They are 
just right. 


ge that a trial could 
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Demystifying CIPA Russias Eliminationist Rhetoric 
Against Ukraine: A Collection 
ald begin with what CIPA does not do. CIPA does not give by Caran 


Any discussion of CIPA sh 
asecutors or the U.S. Intelligence Community authority to unilaterally declare that a 


defendant may be prosecuted without seeing the government's evidence. It do 


not require Tracking UNGA 78: Notable Moments 
protected or and Key Themes 
by Gwendoiyn Whidden Kat 


judges to accept Executive Branch decisions about what information must b 


haw to protect it. And it does not change the substantive laws of evidence or discovery. 


Rather, CIPA helps the government predict the risks that trying a national security case will 


expose classified information to the public, which in turn could cause further harm. CIPA ee 


by Ryan Goodman, Justin Hendrix and 
rors, the U.S. Intelligence Community, defendants, and judges with a Norman L Esen 

procedural framework to determine what classified information the government must 

disclose to the defendan 


provides prosec 


discovery, what classified information the government must 


reveal to the public during trial and other proceedings, and whether and how individual po 
items of classified information will be protected from disclosure at each stage of a Symposium: International Law in 
ion. The substantive law that courts apply within this framework is not unique to SE = The Mea omy 


classified information. It applies the same principles that underlie, for example, the 4 


protection of infi 


mants’ and victims" identities and information to avoid jeopardizing their 


Introducing Just Security's Series 
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safety. 


Litigation and decisions on these points all occur early on in a case. This avoids surprises in iii 


the course of a prosecution. It also provides the government with the opportunity to 


immediately appeal adverse rulings. Ultimately, if judges rule that fairness to a defendant Its Time to Establish a Syria 
requires the government to disclose classified information that the government seeks to apasa 


protect, the government can dismiss or modify the charge to reduce or eliminate its p 


disclosure obligation before the proceedings con 


inue. In other words, a judge does not have 


to grant the government's requests to protect classified information, but the government can 


always take its ball and go home 
Purpose of CIPA 


CIPA was enacted in 1980, about three years after Congress began a study of unauthorized 
disclosures of classified information. As the Senate Judiciary Committee recounted, that 


idy found that “prosecution of a defendant for disclosing national security information 


mation the laws seek to 


protec 
it becomes to enforce the laws that 


uard our national security,” because in an Espionage 


case “the government often must choose between disclosing classified information or letting 


e conduc 


go unpunished.” That dilemma gave rise to the “graymail” problem: the ability 


of defendants to threaten disclosure of classified information in the course of trial and 


thereby constrain the government's ability to prosecute cases involving classified 


informati 


1. As the Committee described it, however, “graymail” is not “limited to instances 


of unscrupulous or questionable conduct by defendants.” Rather, 
and good-faith efforts by defense teams to engage in discovery, conduct 
and present a defense can pose the same risk of disclosing classified information 


entirely proper, honorable, 
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Congress designed CIF Ip stre: -nforcement of laws designed to protect 


both national security and civil liberti 


s." CIPA is intended to resolve the conflict between 


infor it. Based on the 


otecting clas tion and prosecuting those 


who compromi 
sct the interests involved, Congress established the 


need to 


arefully balance and pro 


following framework to guide courts in making step-by-step assessments. 


First Steps 


CIPA itself provides a step-by-step process for the parties and the court to follow. First, CIPA 
Section 1 defines “classified information” as material that the U.S. government has 
determined requires protection against unauthorized disclosure for national security 
reasons. CIPA therefore covers information classified under Executive Order 13526 and 
Restricted Data” as defined in the Atomic Energy Act based on the government's prior 
decision that the information meets national security-based standards for protection. Those 


standards are ni 
at has been produced by or for the government and 
merated subj 


bitrary. The government can only classify national security information 


ral 


hat relates to at least one of si 


en eas. In addition, the level of classification is based on the 
degree of damage that unauthor 


to cause. A “Top Secret” classification corresponds to “exceptionally grave damage.” “Secret” 


matte! 


d disclosure of information reas 


ably would be expected 


classification to “serious damage,” and “Confidential” classification to “damage.” A 
or OCA, mu: 


designated high-level official known as an Original Classification Autho 
tify or des 


able 


he potential damage 


Whether to classify information is an Ex 
whether information is classified. 


utive Branch decision. Courts do not decide 


Pros perally commence CIPA proceedings by moving for a pretrial conference under 


tors g 


CIPA Section 2. Most judges have not presided over cases that involve classified information 


and may not be familiar with national security information, protecting intelligence sources 


d methods, and the sometimes arcane and cumbersome processes the government uses to 


such information secure. CIPA Section 2 motions therefore often include a preview of 
the stages of CIPA. See, eg., United States v. Reality Winner, No. 1:17-cr-34, ECE No. 30 (S. 
Ga. June 19, 2017); United States v. Harold T. Martin II], No. 1:17-cr-69, ECF No. 41 (March 6, 
2017). This allows the court to set a schedule that provides sufficient time to litigate each 
stage and anticipate case-specific issues that may aris 


Ina CIPA Section 2 motion, prosecutors also move for the appointment of a Classified 
Information Security Officer (CISO). At Section 9, CIPA directs the Chief Justice of the U.S. 
Supreme Court to prescribe rules for protecting classified information in the course of 
litigation, and those procedures direct judges to designate a CISO from the Department of 
Justice (DOJ) Litigation Security Group. Although CISOs are DOJ employees, when they 
support classified litigation they are ution team and s 
capacity” on behalf of the court. For exan 
classified information, initiate the security clearance process for defense counsel and court 
staff, provide secure spaces for storing and processing classified information, and advise the 
court on security procedures. 
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Next, if prosecuta 
move under CIPA Section 3 for a protective order that prohibits disclosure of any classified 


anticipate providing classified information to the defense team, they 


information that the government produces. Protective orders are routinely used in court 
s to protect privacy 
information. CIPA provides that the court “shall” issue such an order upon the gi 
. The process of obtaining a Section 3 protective order is usually as straightforward as 
y other protective order, such as those commonly issued in relation to discovery 
and subpoenaed material, but defense counsel sometimes push back, as the def 
the Winner case did. After back-and-forth briefing, the court in Winner found that the 
government's proposed protective order did “not preclude the defense fre 


ade secrets, informants’ identities, and oth 
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ising classified 
information” in the case, but rather “merely require[d] the defense to comply” with “standard 


procedures for protecting classified information in the context of criminal cases.” 
Discovery 


Section 4 is generally where CIPA litigation begins to get contentious. This provision 
provides the framework for the court's decisions regarding discovery. The same principles 
and obligations that govern discovery in any other criminal case apply in a national security 
prosecution. In an Espionage Act case, the core evidence against the defendant-the national 
defense information that the defendant stole, retained, or disclosed-_is likely to be classified. 
CIPA Section 10 explicitly requires prosecutors to notify a defendant of the material on 
Which it intends to rely in proving elements that involve national defense or classified 
information. Other evidence that shows the defendant's actions or communications may also 
be classified because of how it was obtained. Still other classified information may be 
discoverable even if the government does not intend to use it as affirmative evidence — the 
same obligations to disclose exculpatory material, prior statements of witnesses, and other 
categories of information remain unchanged. Accordingly, DOJ policy, specifically Section 9- 
20.210 of the Justice Manual, directs prosecutors to seek out and review classified 
information at other agencies to determine whether any such information is potentially 
discoverable. After prosecutors assess their discovery obligations as to classified information, 
they may move to protect it. 


At the discovery stage, prosecutors have three potential options. They may move to: 


1. “delete” specific classified information from discovery; 
2. substitute a summary of the information a classified document contains instead of 

producing the document itsel 
3. stipulate to relevant facts that the classified information would intend to prove. 


“Deletion” usually consists of redacting portions of a document, but can also entail 
withholding a document in its entirety. The government may also move to provide classified 
discovery to counsel only, and not the defendant, although that issue arises more often in 
terrorism cases than in Espionage Act cases because Espionage Act defendants generally 
have already had access to the classified information at issue. The government, of course, 
cannot use any of these protective measures unilaterally. Rather, the court has the discretion 
to authorize prosecutors to take these steps “upon a sufficient showing.” CIPA allows the 
court to permit prosecutors to make ex parte submissions — ie., submissions that the defense 
does not see —to explain why each item of classified information requires the type of 
protection requested. 


‘The use of ex parte proceedings is not unique to CIPA and makes sense. After all, the entire 
purpose of an application to protect classified information, an informant’s identity or 
address, or other sensitive information from disclosure to a defendant would be undermined 
if the defendant received prosecutors’ submissions. It is not unusual for courts to permit 
defendants to submit their own ex parte submissions, for example to describe defense 
theories in order to help the court assess the relevance to the defense of the information the 
government seeks to protect. In this manner, the court ensures that the defendant receives 
information that discovery principles require the government to disclose, but limits 
discovery of classified information to material that is necessary to a fair proceeding. 


Significantly, CIPA does not provide the substantive law for the court to apply. That derives 
from Rule 16(d) of the Federal Rules of Criminal Procedure and associated case law. Rule 
16d), which applies in every federal criminal case, authorizes a court to “deny, restrict, or 
defer discovery or inspection, or grant other appropriate relief,” by good cause shown, 
Similar to CIPA Section 4, Rule 16(d) allows a party to argue ex parte in support of protecting 
information from disclosure. There are limits to this authority. Under a doctrine adopted in 
United States v. Yunis from criminal cases such as Raviaro v. United States, which involved 
protecting the identity of confidential informants for safety reasons, a court will examine 
whether the information the government seeks to protect is “relevant to the determination 
of... guilt or innocence,” “helpful to the defense,” and “essential to a fair determination of 
the cause." Ifthe court finds that withholding a particular classified document would deprive 
the defendant of due process, prosecutors can seek the court's approval of @ summary or 
admission of the relevant information to provide instead of the document itself. 


Prosecutors’ determinations that particular classified information will be discoverable, 
paired with their assessments of the likelihood that a court will apply requested protections 
in discovery, is an important factor in discussions with the U.S. Intelligence community 
elements that control the classified information at issue. Prosecutors cannot use or disclose 
that information without the originating agencies’ approval, and the originating agencies are 
not obligated to grant that permission. Discussions about the agencies’ willingness to allow 
disclosure are often spirited and can take some time. In the end, if agencies refuse to permit 
disclosure of specific information to the defense team, despite the fact that the defense team 
will have received security clearances and will be required to keep the information in an 
approved secure location, prosecutors will not be able to fulfill their legal and ethical 
obligations in discovery—most significantly, exculpatory information that prosecutors must 
disclose under Brady v. Maryland — if they proceed. As a result, if agencies withhold 
permission, prosecutors must dismiss or modify their case to render that information non- 
discoverable, if possible. 


‘These same analyses will apply to the use of classified information at trial, discussed below. 
In that context, the stakes are higher, because the default is that evidence will be disclosed to 
the public. 


Defendant's Obligations 


CIPA also imposes obligations on the defense team. If a defendant expects to either 
introduce classified information in a proceeding or otherwise cause its disclosure, Section 5 
requires the defendant to provide notice to prosecutors. Defendants may not disclose or 
cause disclosure of any classified information in connection with the prosecution without 
providing notice first. Section 5 authorizes the court to preclude disclosure if the defendant 
does not give notice. 


‘The purpose of the notice requirement is to facilitate pretrial litigation of the admissibility 
of classified information, Accordingly, the notice must be sufficiently specific to allow 
prosecutors to make informed arguments. Debates over the sufficiency of notice can be 
protracted. Defense teams resist disclosing details of their anticipated evidence for 
Constitutional reasons and to protect their trial strategies. It is well settled, however, that 
the Section 5 notice requirement does not violate the Fifth or Sixth Amendment and is 
reasonable in light of the need to safeguard classified information. 


Pretrial Determination of Admissibility 


In an ordinary criminal case, the court may rule on the admissibility of evidence during trial. 
Under CIPA Section 6(a), the court resolves questions of admissibility in advance of trial or 
any pretrial proceeding. Particularly as to classified information the defense anticipates 
disclosing, this provides the government with the opportunity to object and obtain rulings 
before the information is exposed, an opportunity to appeal adverse rulings early in the 
proceedings, and, if necessary to protect classified information, dismiss or modify its case 
rather than permit disclosure, 


CIPA does not change the rules of evidence. Admissibility decisions under CIPA Section 6(a) 
are governed by the same principles that govern evidence in any other prosecution. 
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(U) Change Log 


(U) The complete history of changes is posted on the SMP website under “IC Markings System Register and Manual.” 
This revision includes the following changes: 


(U) Front Cover 
= Updated effective date and points of contact. 


(U) Table of Contents 
= Regenerated. 


(U) Global 
= Removed references to rescinded DCIDs. 
= Where warranted, updated language to provide readability and clarity. 
= Corrected typographical errors, font inconsistencies, notional example errors, and spacing issues. 
= Following changes to the classification of S//NF tetragraph codes from S//NF to U, consolidated Annex B (S//NF 
tetragraphs) into Annex A (unclassified tetragraphs) and moved and renamed Annex C (trigraph country codes) to 
Annex B. 


(U) Change Log 
= Revised to describe modifications made for this release. 


A. (U) Introduction 
= Pursuant to ICD 710, updated language to more clearly describe the IC Markings System Register and Manual 
as the basis for implementing the IC’s marking policies. 
= Referenced the publication of the 32 CFR, Part 2002 within the Federal Register. 
= Provided guidance that CUI markings shall not be used until they are codified in accordance with national and IC- 
level implementation guidance. 
= As itis no longer maintained, removed reference to Annex D from the IC Markings System Structure (Table 1) 


B. (U) General Markings Guidance 
= Updated language specific to FD&R markings on unclassified DAPs to facilitate reliance on banner roll-ups to 
inform releasability of FOUO. 


C. (U) Portion Marks- No changes 
D. (U) Banner Line- No changes 


E. (U) Classification Authority Block 
= Removed guidance on DNI Only and DCI Only and provided direction on the use of 25X1, EO 12951 to specify 
use by D/NGA in classifying original imagery and guidance on applying a derivative classification date for the 
retired marking. 
= Provided supporting language for declassification of RD, FRD and TFNI by DOE. 


F. (U) Legacy Conirol Markings - No changes 


G. (U) IC Markings System Register 
= Removed ENDSEAL 
= Per DODI 5210.02, updated CNWDI entry to reflect that a Q clearance is not required for access to CNWDI by 
DOD personnel. 
= As it is no longer maintained, removed reference to Annex D from the IC Markings System Register. 
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H. (U) IC Markings System Manual 
1. U.S. Classification Markings 
= Added language to clearly define UNCLASSIFED as a “status” not a classification level. 
4. Sensitive Compartmented Information Control System Markings 
= Removed EL as a separate control system and transferred associated legacy EL compartments (ECRU & 
NONBOOK) to the SI control system. 
= Updated the Markings Register and Access Rights and Handling (ARH) to reflect the transfer of EL 
compartments to SI control system. 
= Removed all marking examples with EL association. 
= To more clearly reflect that the HCS marking is a legacy marking, updated HCS entry to clearly show that 
HCS is a “legacy” marking as opposed to an “authorized” marking. 
= Added GEOCAP definition to the TALENT KEYHOLE manual entry. 


6. Atomic Energy Act Information Markings 

= Updated CNWDI entry to reflect DoD 5210.02 as additional policy guidance. 

= Updated CNWDI entry to reflect CNWDI as a DoD modifier for RD 

= Updated RESTRICTED Data (RD) entry to reflect that all RD shall be marked NOFORN unless a sharing 
agreement has been established per the Atomic Energy Act. 

= Updated FORMALLY RESTRICTED DATA (FRD) entry to reflect that all RD shall be marked NOFORN 
unless a sharing agreement has been established per the Atomic Energy Act. 

= Updated SIGMA [#] entries to reflect that additional admonition blocks may be required on the first on the first 
page of a document. 


7. Foreign Government Information 
= Moved guidance on the derivative use of NATO information to Appendix A, NATO Protective Markings 


8. Dissemination Control Markings 
= Updated NSA Eyes Only dissemination control marking to reflect updated waiver granted by the ODNI on 01 
October 2016. 
=" Updated CUI implementation date from 14 September to 14 November 
= Updated ICD 206, Sourcing Requirements for Disseminated Analytic Products, date from 17 October 2007 to 
22 January 2015, 


I. (U) Banner line Syntax History- No changes 


J. (U) Marking Examples 
= Removed “notional” examples with banners or portion markings with Confidential 


K. (U) Acronym List 
= Removed EL 


(U) Appendices and Annexes — The appendices and annexes of this document may also contain revisions. Refer 
to the Change Log in each document for a list of specific changes. 
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Tres documerrt FS Tot approved for pubtic release: 
A. (U) Introduction 


1. (U) Authority 


(U) Intelligence Community Directive (ICD) 710, Classification Management and Control Markings System, dated 21 June 
2013, and associated ICD 710 policy guidance issuances (e.g., ICPG 710.1), govern the implementation and oversight of 
the Intelligence Community (IC) classification management and control markings system (hereafter referred to as “IC 
markings system”), which provides the framework for accessing, classifying, disseminating, and declassifying intelligence 
and intelligence-related information (hereafter referred to as “information’). 


(U) These regulations provide the framework to protect sources, methods, and activities, while ensuring that information is 
available to the consumers without delay or unnecessary restrictions. The IC markings system includes all markings 
added to classified and unclassified information to communicate one or more of the following: classification, 
compartmentation, dissemination controls, foreign disclosure or release authorizations, and other warnings. 


(U) The IC marking system augments and further defines national-level guidance on marking requirements for classified 
information that is found in Executive Order (EO) 13526 and the companion Information Security Oversight Office (ISOO) 
Implementing Directive found in Title 32 of the Code of Federal Regulations Part 2001 (32 CFR 2001), and for Controlled 
Unclassified Information (CUI) found in EO 13556, Controlled Unclassified Information. This system does not stipulate or 
modify the classification authority information required by EO 13526 and the ISOO Implementing Directive; any guidance 
related to classification authority is reproduced in this document for completeness and user understanding. 


(U) Following the 14 September 2016 publication of 32 CFR, Part 2002 within the Federal Register, the markings 
and guidance for CUI will be revised and incorporated into a point release of the IC Markings System Register 
and Manual. Therefore, CUI markings shall not be used until they are codified in accordance with national and IC- 
level implementation guidance. 


(U) The IC markings system is implemented and maintained through the /ntelligence Community Markings System 
Register and Manual (hereafter referred to as the “Register and Manual.”) This document is reviewed and a revision 
published at least annually or as needed. IC elements may submit requests for new markings, marking waivers, or other 
modifications to the system through their Classification Management Implementation Working Group (CMIWG) 
representative who, after review and concurrence with the request, forwards it to the Office of the Director of National 
Intelligence (ODNI)/Policy & Strategy (P&S)/Information Management Division (IMD) via the Security Markings Program 
(SMP) office. A list of CMIWG agency representatives is available on the SMP websites. ODNI/P&S/IMD is the approval 
authority for all requests for marking waivers. 


(U) The IC markings system, as defined and described in this document, is the basis for IC technical standards and 
automated classification and control markings systems. IC elements have up to 12 months from the publication date to 
incorporate into IC automated systems any modifications to the Register and Manual and machine-readable standards. 
IC elements may submit a request for waivers to systems implementation of markings to the IC Chief Information Office 
(CIO) or designee consistent with ICS 500-20, Intelligence Community Enterprise Standards Compliance. 


(U) This document and the guidance contained herein do not apply to information that is not intelligence or intelligence- 
related information that may otherwise be protected by statute or presidential directive. 


2. (U) Purpose 


(U) The IC marking system prescribes a standard set of markings to be applied to human-readable information to include 
information rendered or displayed in an electronic environment. The Register portion of this document identifies the 
authorized classification and control markings for use in the banner line marking title, and the authorized portion mark. 
The Manual portion of this document provides the amplifying and explanatory guidance, the human-readable syntax, and 
marking instructions for each authorized marking used to communicate and control the access to and flow of intelligence 


12 
UNCLASSIFIED//rexs— 


25 


UNCLASSIFIED//Fee— 


information. The markings in the Manual are to be applied to human-readable information regardless of medium (e.g., 
text, image, graphics, electronic documents including web pages), unless a waiver has been granted. 


(U) Documents transmitted over IC automated systems, including networks and telecommunications systems that collect, 
create, communicate, compute, disseminate, process, and store classified information, must conform to EO 13526 and 32 
CFR 2001 for marking electronic information and to IC standards and technical specifications on machine-readable 
classification and control markings. The IC CIO has identified the Classification Management Tool (CMT) in IC Standard 
(ICS) 2008-500-05 as the required automated system for IC classifiers to create, apply, store, and reuse classification and 
control markings in TS SCI email and MS Office products (e.g., Word, Excel, and PowerPoint). 


(U) Pursuant to ICD 710, the IC Markings System Register and Manual serves as the policy basis for implementing IC 
markings and cites the applicable authority(ies) and sponsor(s) for each marking. Some of the dissemination control 
markings and non-Intelligence Community dissemination control markings are restricted for use by specific agencies. 
These markings are included to provide guidance on handling information that bears them. Inclusion in this document 
does not authorize other agencies to use these markings. Non-US Protective Markings are used to translate (as 
appropriate) protective markings received from international organizations (e.g., NATO) or foreign governments. Joint 
classification markings are used when the US owns or produces intelligence information with one or more countries 
and/or international organizations on information that is owned or produced by more than one country and/or international 
organization. 


3. (U) Applicabilit 


(U) The guidance in the Register and Manual applies to the IC, as defined by the National Security Act of 1947, as 
amended, and such other elements of any other department or agency as may be designated by the President, or 
designated jointly by the DNI and the head of the department or agency concerned, as an element of the IC. When 
established by written agreement or understanding, this document also applies to federal departments and agencies; 
state, local and tribal governments; private sector organizations; and other non-IC elements that handle, store, or 
disseminate intelligence information. 


(U) This document does not address internal IC element control markings (i.e., caveats) or warnings and notices (e.g., 
US-Person Notice or DoD Distribution statements) that may or may not be associated with a registered marking and that 
may be applied to information to meet legal procedural requirements, or indicate addressing, routing, or distribution 
guidance. Refer to the applicable IC element guidance associated with these markings (i.e., caveats) and warnings or 
notices for guidance. 


(U) This document provides authorized markings for both unclassified and classified IC information. Existing practices for 
marking sensitive unclassified information remain in effect until the implementation of CUI markings. 


(U) The marking guidance in this document does not alter or replace the policies and procedures of foreign governments, 
NATO, or non-IC elements of the United States Government (USG) for marking, handling, storing, or retaining 
information. The more stringent marking requirement will apply if there is a conflict between any marking guidance 
contained in this document and those stipulated in the specific foreign, NATO, or USG non-IC elements’ policies. 
Promptly report any marking conflicts to your agency's CMIWG representative. 


4. (U) IC Markings System Structure 


(U) This publication provides the authorized classification and control markings values and standardized structure and 
format for applying classification and control markings to intelligence and intelligence related information. Standardized 
classification and control markings enhance protection and promote interoperability among information systems while 
protecting intelligence sources, methods, and activities. 
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(U) The artifacts listed in Table 1 below together define and describe the implementation of the IC marking system: 


Table 1: (U) IC Markings System Artifacts 


(U) This table is UNCLASSIFIED. 


Artifact Description 
Register The Register provides a list of all authorized markings. 
Annex A — Tetragraph Codes (U//FOUO) Annex A supplements the Register and provide the codes 
Annex B — Trigraph Country Codes representing international organizations, alliances, coalitions 


and countries authorized for use by IC elements consistent 
with specific disclosure and release requirements. Annex A is 
updated based on mission need as assessed by ODNI/Partner 
Engagement (PE), and Annex B corresponds to the 
Geopolitical Entities, Names, and Codes Standard (GENC). 


Manual The Manual provides detailed guidance for each marking 


authorized in the US markings system for intelligence 
information to include the marking definition, policy basis, 
applicability, and business rules for proper application. 


Appendix B — NATO Protective Markings 
Appendix C — UN Protective Markings (classified, 


Appendix A — Non-US Protective Markings The Appendices supplement the Manual and are used to 
(includes the Five Eyes Marking translate non-US markings into a standardized format and 
Comparisons) equivalent marking. 


releasable) 


Unauthorized IC Classification and Control Provides a listing of unauthorized markings and offers re- 
Markings marking guidance, if any. Note: This artifact is only available 


on the SMP’s JWICS website. 


5. (U) Marking Categories 


(U) The IC marking system has nine categories of classification and control markings: 


PON 


a 


SOON 


Non-US Protective Markings with dissemination controls - Items 1-3 are mutually exclusive 

Joint Classification Markings} within a banner and portion mark 

Sensitive Compartmented Information (SCI) Control System Markings — used by the IC to identify 
information that has special access requirements not met by classification level, alone 

Special Access Program (SAP) Markings — used primarily by non-IC departments and agencies to identify 
information that has special access requirements not met by classification level, alone 

Atomic Energy Act (AEA) Information Markings — used to identify information regarding nuclear matters 
Foreign Government Information (FGI) Markings — used to identify information from a foreign source 
Dissemination Control Marking — IC markings used to identify the expansion or limitation on distribution 
Non-Intelligence Community Dissemination Control Markings — non-IC markings used to identify the 
expansion or limitation on further distribution 


US Classification Markings } Required on classified documents and unclassified documents 


(U) As depicted in Figure 1, the type of information to be marked establishes which IC marking system artifacts and 
sections within those artifacts are applicable, the types of products generated, and the format or translation prescribed. 
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(U) This figure is UNCLASSIFIED. 
Information Documents Product Description 


Register 
Manual 
Annexes A-C 


Prescribes US translation of 
non-US markings for 
dissemination and reuse in 


esh& 
s Pr 
Register ¥ E 
- Manual, Section 7 

Foreign , Prescribes values, syntax, 

Annexes A-C US 
a P and format for FGI 

Appendices A-C s derivatively used/sourced 


FGI in a US product 


Prescribes values, syntax, 
and format for information 
Register 
Manual 
Annexes A and C 


Figure 1: (U) Marking US, Foreign, and Joint Information Using IC Markings System Artifacts 


6. (U) Formatting 


(U) Banner Line and Portion Marking — For US information, the first value of a banner line or portion mark is always the 
US classification marking. For non-US or Joint information, the banner line and portion mark must always start with a 
double forward slash (“//”) with no interjected space, followed by the non-US or JOINT classification marking. The banner 
line must always have the classification marking capitalized and spelled out for US, non-US, and Joint information; no 
abbreviations are authorized. Portion marks must always be placed at the beginning of the portions, immediately 
preceding the text to which it applies. This position affords maximum visibility to the reader. Portion marks must be 
enclosed in parentheses. Portion marks must use the same order and separators (i.e., slashes, hyphens, commas, or 
spaces) used for the banner line, except for the SENSITIVE BUT UNCLASSIFIED NOFORN (SBU NOFORN) and LAW 
ENFORCEMENT SENSITIVE NOFORN (LES NOFORN) markings, where the banner line marking does not use a hyphen 
to connect the NOFORN, but the portion mark uses a hyphen (i.e., SBU-NF and LES-NF). 


(U) Sensitive Compartmented Information (SCI) Control System Markings — must follow the classification, if 
applicable, and are preceded by a double forward slash with no interjected space. SCI control systems and their 
compartments must be kept together, connected by a hyphen (“-”). SCI control system compartments and their sub- 
compartments must be kept together, separated by a space. SCI markings are alphanumeric values. Multiple SCI control 
systems must be separated by a single forward slash (“/”). All SCI control systems, their compartments, and sub- 
compartments must be listed within each hierarchical level in ascending sort order with all numbered values first, then 


followed by alphabetic values (this ordering guidance applies for both published and unpublished markings). For example: 
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TOP SECRET//123/SI-G ABCD DEFG-MMM AACD//ORCON/NOFORN where 123 and SI are SCI control systems, G and 
MMM are SI compartments, ABCD and DEFG are sub-compartments of G, and AACD is a sub-compartment of MMM. 


(U) Special Access Program (SAP) Markings — must follow, SCI markings, if applicable, and are preceded by a double 
forward slash with no interjected space. The first value in the SAP category is the SAP category indicator either 
“SPECIAL ACCESS REQUIRED-’ or “SAR-” (the authorized abbreviation). The hyphen appearing with the SAP category 
indicator is not a marking separator, but should be considered part of the SAP category indicator for marking syntax 
purposes. Following the SAP category indicator must be the SAP program indicator which is the program’s nickname or 
authorized digraph or trigraph. If multiple SAP program identifiers are required, each subsequent SAP program identifier 
must be listed in ascending sort order with all numbered values first, followed by alphabetic values separated by a single 
forward slash without interjected spaces. The SAR- category indicator is not repeated when multiple program indicators 
are used. Reflecting SAP program hierarchy below, the program identifier level in the portion or banner markings is 
optional and based on operational requirements. Compartment(s) (if any) associated with a SAP program identifier must 
be kept with the SAP program identifier listed in ascending sort order with all numbered values first, followed by alphabetic 
values separated by a hyphen. Sub-compartment(s) (if any), must be kept with the compartment, listed in ascending sort 
order with numbered values first, followed by alphabetic values and separated by a single space. For example: 
SECRET//SAR-ABC-DEF 123/SDA-121//NOFORN where ABC and SDA are SAP program identifiers, DEF is a 
compartment of ABC and 121 is a compartment of SDA, and 123 is a sub-compartment of DEF. 


(U) Atomic Energy Act (AEA) Information Markings — must follow, SAP markings if applicable, preceded by a double 
forward slash with no interjected space. AEA Information Markings and their subsets must be kept together, connected by 
a hyphen. Multiple AEA markings must be listed in the order they appear in the Register, separated by a single forward 
slash with no interjected space. An example may appear as: SECRET//RD-CNWDI//REL TO USA, GBR 


(U) Foreign Government Information (FGI) Markings — must follow AEA markings if applicable, preceded by a double 
forward slash with no interjected space. Multiple FGI trigraph country codes or tetragraph codes must be separated by a 
single space. A tetragraph is a four-letter code (unless an exception is granted) used to represent an international 
organization, alliance, or coalition. Trigraph codes used with the FGI marking must be listed first in ascending alphabetic 
sort order, followed by tetragraph codes listed in ascending alphabetic sort order. An example may appear as: 
SECRET//FGI GBR JPN NATO//REL TO USA, GBR, JPN, NATO. 


(U) Dissemination Control Markings — must follow, FGI markings if applicable, preceded by a double forward slash with 
no interjected space. A single forward slash with no interjected space must be used to separate multiple dissemination 
controls. Multiple dissemination controls must be listed in the order they appear in the Register. Multiple REL TO 
countries and/or international organizations must be separated by commas with an interjected space. The “USA” trigraph 
code must be listed first, followed by trigraph codes listed in ascending alphabetic sort order, then tetragraph codes listed 
in ascending alphabetic sort order, e.g., SECRET//REL TO USA, GBR, JPN, ISAF, NATO. 


(U) Non-IC Dissemination Control Markings — must follow, Dissemination Controls, if applicable, preceded by a double 
forward slash with no interjected space. A single forward slash with no interjected space must be used to separate 
multiple controls in the category. Multiple Non-IC dissemination controls must be listed in the order they appear in the 
Register. In the portion mark for non-IC Dissemination Control Markings, the marking and its sub-marking must be kept 
together, connected by a hyphen, (i.e., the portion mark for SBU NOFORN is “SBU-NF’”). 


(U) Use only applicable control marking categories; no placeholders are required for categories that are not applicable. 
Figure 2 provides a graphic representation of the IC marking system categories and formatting as described in this section 
and detailed in this document. 
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-fits—cdocument_ts_not_approved for pubiic releaser 


(U) This figure is UNCLASSIFIED. 


Joint Classification 
Atomic Energy Act Info 


Non-IC Dissemination Controls 


Sample Marking: 


Required, only one Appropriate FD&R marking 
classification type and required on disseminated 
value allowed analytic products 


ao ON 
CLASSIFICATION//SCI,-XXX/SCI,//SAP//AEA//FG! XXX//DISSEM,/DISSEM,/ DISSEM 


Portion and Banner Line Marking Separators: 
II 


/ 


Double forward slash is used to separate marking categories 


Single forward slash is used to separate multiple values within a marking category 
Hyphen is used to link a marking to a sub-marking (e.g., SI-G or RD-SIGMA) 


Space is used to separate multiple sub-markings and multiple trigraph or tetragraph codes in the 
FGI Marking (e.g., //SI-ABD-G XYZW//, //SAR-BP-123 X11/CD-HHH JAD//, or //FG| GBR JPN//) 


Comma is used to separate multiple trigraph or tetragraph codes in the REL TO Marking 


Figure 2: (U) IC Classification and Control Markings Categories and Formatting 


7. (U) Resources 


(U) This document is available electronically on SMP’s website at the following location: 
(6)(3) 50 U.S.C. 30241 


(U) For TEE | informatio 


additional information, questions, or comments on these quidelines please contact the SMP office by e-mail on 
AWiterse(0)(3) 50 U.S.C. 30241 
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B. (U) GENERAL MARKINGS GUIDANCE 
1. (U) Marking Requirements 


(U) Classification and control marking requirements apply to all information, whether in printed or electronic format 
regardless of the medium (e.g., text, image, graphics, and electronic information, including finished intelligence 
disseminated via cables, web pages, wikis, and blogs). “Document” is used throughout this Manual to more effectively 
describe and define marking requirements, but is not intended to limit the types of media on which classification markings 
must be applied. Figure 3 depicts each of the required human-readable marking elements on classified information. 


(U) Classification and control markings must be applied explicitly and uniformly when creating, disseminating, and using 
classified and unclassified information to maximize information sharing while protecting sources, methods, and activities 
from unauthorized or unintentional disclosure. To prevent information from being controlled unnecessarily, to the 
maximum extent possible, information that does not carry a dissemination control marking must not be combined within 
the same portion with information that requires a dissemination control. 


(U) The originating IC element may apply warnings or notices to communicate distribution or handling instructions for the 
information. Any such statements may not restrict dissemination beyond the restrictions already imposed by the 
authorized control markings (i.e., caveats) and must be consistent with any and all control markings applied. 


(U) This figure is UNCLASSIFIED. 


Agency and SECRET//NOFORN e—a Line 
Office of Origin 
(not otherwise L» Agency/Office 
SEa A Addres 

provided in an e- gpn bi 
nnn 22 June 2013¢—-Date of origination 
signature block) 

(U) This is an Unclassified portion 

marked for training purposes only. 

(C//REL TO USA, FVEY) This is a 

. Confidential portion marked for training 
Portion 
ly. 
Markings a 

(S//NF) This is a Secret portion with a 

NOFORN Dissemination Control 

Marking. Marked for training purposes 

only. If the Derived From is 

=o . . fl “Multiple Sources” 

sein Classified By: Unique ID include the list of source 
Classification > Derived From: SCG XYZ, dated materials on or attached 
Authority 01/15/2012 to the document 
Block Declassify On: 20381231 
SECRETINOFORN «————+Banner Line 


Figure 3: (U) Required Human-Readable Marking Elements 
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2. (U) Classified Information Used as a Derivative Source 


(U) In accordance with EO 13526, §2.1 and ICD 710, derivative classifiers must carry forward to any newly created 
documents the pertinent classification, control systems, dissemination controls, disclosure or release authorizations and 
other warnings and notices as directed by the applicable classification guide or source document used as the basis for a 
derivative classification determination. 


3. (U) Foreign Disclosure and Release Markings 


(U) All foreign disclosure and release (FD&R) decisions must be made in accordance with ICD 403, Foreign Disclosure 
and Release of Classified National Intelligence. The authority within IC elements to make FD&R decisions rests with IC 
element heads, Senior Foreign Disclosure and Release Authorities (SFDRAs), and Foreign Disclosure and Release 
Officers (FDROs), as detailed in ICD 403, §E.3. Intelligence Community Policy Guidance (ICPG) 710.2/403.5, Application 
of Dissemination Controls: Foreign Disclosure and Release Markings provides direction and guidance on the use of 
control markings to communicate FD&R decisions made in accordance with ICD 403. Classifiers must consult internal 
agency or departmental guidance for FD&R determinations on uncaveated information. When reusing information from a 
source document(s) that has FD&R markings, carry forward the FD&R markings from the source document(s). 


(U) Note: Disclosure is defined in ICD 403 as: “Displaying or revealing classified intelligence whether orally, in writing, or 
in any other medium to an authorized foreign recipient without providing the foreign recipient a copy of such information 
for retention.” Release is defined in ICD 403 as: “The provision of classified intelligence, in writing or in any other 
medium, to authorized foreign recipients for retention.” 


a. (U) FD&R Banner Markings on IC Disseminated Analytic Products (DAPs) 


(U) ICD 710 provides policy guidance on the application of FD&R markings. To facilitate the appropriate foreign 
disclosure and release of information, ICD 710, §E.5 requires originators to apply FD&R markings using the following 
guidelines: 


= Originators must explicitly mark classified disseminated analytic products (DAPs) with the appropriate FD&R(s) to 
include one or more of the following markings: NOFORN, REL TO, RELIDO, or DISPLAY ONLY; 

= Originators are encouraged to apply appropriate FD&R markings as soon as practicable on DAPs; 

= Other IC information (i.e., not DAPs, such as documents relating to internal, administrative, or element-specific 
matters) is not required to be explicitly marked for FD&R. This information must be handled in accordance with 
the terms under which the information was made available. When possible, those terms should indicate the 
appropriate FD&R marking. Note: Internal agency or departmental guidance may require explicit FD&R 
markings on other IC information (i.e., not DAPs.) Classifiers should consult this guidance to determine marking 
requirements for non-DAP information. 


b. (U) FD&R Portion Markings on IC Disseminated Analytic Products (DAPs) 


(U) DAPs are defined in ICD 206, Sourcing Requirements for Disseminated Analytic Products, Appendix A — Glossary, as 
“Products containing intelligence analysis intended to convey authoritative agency, bureau, office, center, department, or 
IC analytic judgments and officially distributed to consumers outside the producing IC element.” To facilitate sharing of 
intelligence information, IC classifiers must apply FD&R marking(s) when reusing or derivatively sourcing into an IC DAP 
classified information that was not marked previously by the originator, as follows: 


= Mark as RELIDO in the absence of other guidance from the originating agency, if the information is classified, 
created on or after 28 June 2010, and uncaveated (see note below). 
= Mark as NOFORN in the absence of a positive release determination by the originating agency, if the information 
is classified, created on or after 28 June 2010, and caveated (see note below). 
= Mark as NOFORN in the absence of a positive release determination by the originating agency, if the information 
is classified and created prior to 28 June 2010 whether uncaveated or caveated. 
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= Mark as follows if the information is unclassified: 

e FD&R markings are optional in the absence of other guidance from the originating agency, if caveated IC 
information (i.e., the information is not marked with DoD/DOE UCNI, DSEN, or any non-IC dissemination 
control). 

e Mark as the FD&R indicated in the overall classification of the source document in the absence of a positive 
release determination by the originating agency, if caveated non-IC information (i.e., the information is marked 
with DoD/DOE UCNI, DSEN, or any non-IC dissemination control). 

e |f uncaveated, FD&R markings are optional. Follow internal agency procedures regarding applying FD&R 
markings. 


(U) Note: Based on ICD 403 guidance, the terms uncaveated and caveated are defined as follows: 


= “Uncaveated” means bears no FD&R markings and no AEA markings, SAP markings, and/or dissemination 
control marking(s) (i.e., all IC and non-IC dissemination controls). SCI controls are intentionally not listed. If only 
an SCI marking is present, the information is considered uncaveated. 

= “Caveated” means bears no FD&R markings, but has one or more AEA markings, SAP markings, and/or 
dissemination control marking(s) (i.e., all IC and non-IC dissemination controls). SCI controls are intentionally not 
listed. If only an SCI marking is present, the information is considered uncaveated. 


c. (U) FD&R Portion Markings on Non-IC Information Contained in IC DAPs 


(U) Non-IC information, to include classified military information (CMI), may be sourced in IC DAPs in accordance with the 
terms under which the information was provided. While ICD 710 FD&R marking requirements are not applicable to non- 
IC US Government departments and agencies, IC classifiers that reuse non-IC information in a classified or controlled 
unclassified IC DAP must ensure each portion of non-IC information is marked as described above in Section B.3., 
paragraph b, FD&R for IC Disseminated Analytic Products (DAPs), and summarized below in Table 2, FD&R Markings 
Summary, unless otherwise specified or marked by the originator. 


d. (U) FD&R Markings on Foreign Government Information (FGI) Contained in IC DAPs 


(U) FGI may be sourced in IC DAPs (classified and controlled unclassified) in accordance with the applicable foreign 
sharing arrangement(s). If the originating country allows further sharing by the United States, a REL TO USA, [LIST] 
marking must be used. If the originating country prohibits further sharing by the United States, a NOFORN marking shall 
be used. When derivatively sourcing FGI that does not have FD&R marking(s) in a classified or controlled unclassified IC 
DAP, it must be marked as NOFORN in the absence of a positive release determination by the originating agency or 
source country. 


e. (U) FD&R Portion Marking and Roll-Up Guidance for IC DAPs 


(U) All classified portions of IC DAPs must be portion marked to include explicit FD&R marking(s) in accordance with 
Section B.3., paragraph b. 


(U) The application of FD&R markings on unclassified (including caveated) IC DAP information is allowed but not 
required. IC classifiers must follow internal agency procedures for the use of FD&R markings on unclassified IC DAP 
information. 


(U) The roll-up of FD&R portion markings to the banner line of a classified IC DAP must convey the most restrictive FD&R 
marking in accordance with Section D, paragraph 2, Table 3 of this document, FD&R Markings Precedence Rules for 
Banner Line Roll-Up. 
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f. (U) FD&R Portion Markings on Other IC Information 


(U) FD&R markings are not required on other classified IC information (i.e., not DAPs) for which ICD 710, §E.5 is not 
applicable. Other intelligence information that bears no explicit FD&R marking must be handled in accordance with the 
terms under which that information was made available. When those terms are unknown, the information must be 
handled in accordance with the guidance for IC DAPs based on the date the information was created and whether it is 
caveated or uncaveated by the originator. Refer to Section B.3., paragraph b., FD&R for IC Disseminated Analytic 
Products (DAPs). 


(U) Explicit FD&R markings are optional on other unclassified IC information. Follow internal policies, processes and 
procedures, as well as applicable provisions of law for the application of FD&R markings on unclassified information. 


U) FD&R Portion Markings on Non-IC Information Contained in Other IC Information 


(U) Non-IC information may be sourced in other IC information in accordance with the terms under which the information 
was provided. While ICD 710 FD&R marking requirements are not applicable to non-IC US Government departments and 
agencies, IC classifiers who reuse non-IC information must ensure it complies with Section B.3., paragraph i. 


h. (U) FD&R Markings on FGI contained in Other IC Information 


(U) FGI may be sourced in other IC information in accordance with the applicable foreign sharing agreement(s). If the 
originating country allows further sharing by the United States, a REL TO USA, [LIST] marking shall be used. If the 
originating country prohibits further sharing by the United States, a NOFORN marking must be used. While ICD 710 
FD&R marking requirements are not applicable to foreign governments or international organizations, IC classifiers who 
reuse FGI information in other IC information must ensure it complies with Section B.3., paragraph i. 


i. (U) FD&R Portion Marking and Roll-Up Guidance for Other IC Information 


(U) FD&R markings are not required in the portion marks of other IC information documents. If none of the other IC 
information document portions have FD&R markings, follow only the banner line roll-up rules for classification level and 
any other controls present in accordance with Section D, paragraph 2. 


(U) FD&R markings must be applied by derivative classifiers in the banner line of other IC information documents when 
there is a mixture of FD&R-marked and -unmarked portions. Treat the FD&R-unmarked portions as reflected in Table 2 
below, and follow banner line roll-up rules in accordance with Section D, paragraph 2 and Table 3 of this document, FD&R 
Markings Precedence Rules for Banner Line Roll-Up. 


Table 2: (U) FD&R Markings Summary 
(U) This table is UNCLASSIFIED. 
FD&R Portion Marking Guidance for IC DAPs and Other IC Information 


Classified + uncaveated + on/after 28 June Mark as RELIDO in IC DAPs 


2010 Handle as RELIDO in other IC Info, marking encouraged 
but not required 


Classified + caveated + on/after 28 June 2010 Mark as NOFORN in IC DAPs 


Handle as NOFORN in other IC info, marking encouraged 
but not required 
Classified + uncaveated/caveated + prior to 28 Mark as NOFORN in IC DAPs 


June 2010 Handle as NOFORN in other IC info, marking encouraged 
but not required 
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FGI w/o FD&R markings Mark as NOFORN in IC DAPs 


Handle as NOFORN in other IC info, marking encouraged 
but not required 


Unclassified + caveated IC info. FD&R marking encouraged, but not required 
(Note: excludes info. with DoD/DOE Handle as explicitly marked if present 
UCNI, DSEN, or non-IC dissems) If not explicitly portion marked, handle in accordance with 


FD&R markings in the document banner. 
FD&R Portion Marking Guidance for IC DAPs and Other IC Information 


Unclassified + caveated non-IC info. Mark as FD&R indicated in the overall classification of the 
(Note: includes info. with DoD/DOE UCNI, source document in IC DAP 
DSEN, or non-IC dissems) Handle as explicitly marked if present. 


If not explicitly portion marked, handle in accordance with 
FD&R markings in the document banner. 


Unclassified + uncaveated Follow internal agency procedures 


4. (U) Marking Electronic Information 


(U) In general, classified national security information (CNSI) in the electronic environment is subject to the marking 
requirements specified in EO 13526. It must be marked with proper classification markings, to the extent such marking is 
practical, to include portion marks, overall classification, and a complete classification authority block. In cases where 
classified information in an electronic environment cannot be marked in this manner, the information must bear both a 
warning to alert users that the information may not be used as a source for derivative classification as well as a point of 
contact and instructions for users to receive further guidance on the use and classification of the information. 


(U) The markings shown in Figure 3 may be augmented or modified for specific electronic environments in accordance 
with ISOO Implementing Directive §2001.23, Classification Marking in the Electronic Environment. This section of the 
directive provides additional guidance on marking the following types of electronic information: e-mail, web pages, 
electronic media files, URLs, dynamic documents and relational databases, bulletin board postings and BLOGS (web 
logs), classified wikis, instant messages and chats, and chat rooms. When fully implemented across the IC, users will rely 
on the CMT automated marking system to ensure all required IC classification and control markings are accurately 
applied. 


(U) The IC technical specification titled XML Data Encoding Specification for Information Security Marking Metadata 
(ISM.XML) defines a data format for exchanging information security marking metadata between automated information 
systems. It provides technical guidance to IC software developers on using XML to encode information security marking 
metadata in XML. Implementation of ISM.XML is declared in ICS 500-21, Tagging of Intelligence and Intelligence-related 
Information, 28 January 2011. In accordance with ICS 500-20, Intelligence Community Enterprise Standards Compliance, 
16 December 2010, IC elements must consult the IC Enterprise Standards Baseline (IC ESB) for compliance 
requirements associated with each specification version. Each version is individually registered in the IC ESB and 
defines, among other things, the location(s) of the relevant artifacts, prescriptive status, and validity period, all of which 
characterize the version and its utility. The IC ClO is responsible for the ISM and associated security marking metadata 
technical specifications. Any changes to the IC markings system that impact these standards will be reflected within 60 


days from the release of the Register and Manual. For questions or concerns regarding ISM.XML, COEUR 
(b)(3) 50 U.S.C. 30241 
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5. (U) Markings and System Waivers 


(U) In accordance with ICD 710 §10.b, IC elements must incorporate any modifications to the Register and Manual into 
automated systems that disseminate information within one year of the modification. After one year, IC systems that 
disseminate information must be modified to reject information not marked in accordance with the Register and Manual, 
unless a markings waiver has been approved by ODNI/P&S/IMD or designee, or a systems waiver has been approved by 
the IC CIO or designee. Requests for markings waivers must be submitted by the IC element’s CMIWG representative to 
ODNI/P&S/IMD/SMP for review. Systems waivers must be submitted by the IC element to the IC ClO/Information 
Assurance Division (IAD). 


(U/A-O¥CyAt this time, the National Security Agency (NSA) and the National Geospatial-Intelligence Agency (NGA) have 
markings waivers. NSA has a markings waiver for the continued use of the EYES ONLY marking on its SIGINT reporting, 
pending legacy system retirement. NSA has also applied to the IC CIO for a systems waiver related to EYES ONLY. NGA 
has a waiver for the application non-US SAP markings on US information to support imagery sharing arrangements with 
foreign partners. SMP retains an unpublished list of these markings due to their sensitivity for the foreign partners and the 
possible risk of broader dissemination to the foreign imagery sharing relationships. These waivers will be evaluated 
annually and extended, as warranted. Contact SMP for additional information regarding these markings. 


6. (U) Change Requests (CR) 


(U) The SMP and IC elements review and validate the IC Markings System annually, as required by ICD 710. Any mid- 
year change requests proposed by an agency’s CMIWG member or SMP are documented and processed by SMP as a 
CR to the markings system baseline. For additional information regarding the CR process, contact the appropriate 
CMIWG representative. 


7. (U) Classification by Compilation 


(U) Data that individually is unclassified or classified at a lower level may become classified or classified at a higher level 
when combined or compiled in a single document if the information reveals an additional association or relationship, not 
otherwise revealed in the individual data items. Likewise, data that is not individually controlled may become controlled 
when combined or compiled in a single document if the compiled information meets the criteria for applying control 
marking(s) under relevant policy, and is not otherwise controlled by the classification and control markings of the 
individual data items. Applying classification and control markings by compilation can be a derivative classification action 
based on existing original classification and control marking guidance or an original classification action. 


(U) If the classification and control markings by compilation reveals a new aspect of information that meets the criteria for 
classification but is not yet defined in an applicable classification guide as an approved classification by compilation, it 
must be referred to an Original Classification Authority (OCA) with jurisdiction over the information to make an original 
classification decision. When a classification or control marking determination is made based on compilation, clear 
instructions must appear with the compiled information as to the circumstances under which the individual portions 
constitute a classified and/or controlled compilation, and when they do not. 


8. (U) Classification Marking Elements 


(U) Classified information and unclassified information with dissemination controls markings must bear the following 
required classification and control marking elements: 


a Classified information: 


e Highest classification level of information contained in the document and any applicable control markings 
placed at the top and bottom of every page (hereafter referred to as the “banner line”) 
e Portion marks (preceding the text to which they apply) 
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e Classification authority block (may appear anywhere on the first page/cover either vertically or horizontally) 
e Date of origin of the document 


= Unclassified information with dissemination control markings: 


e Banner line 
e Portion marks 


(U) Note: The classification authority block and date of document origin are not required markings on unclassified or 
unclassified controlled documents. 


9. (U) Marking Challenges 


(U) Requesters of information and authorized holders of information must seek to resolve classification and control 
marking issues at the lowest possible level in accordance with IC element procedures established under EO 13526, the 
ISOO Implementing Directive, and ICD 710. Authorized holders of information who, in good faith, think that a 
classification or control marking has been incorrectly applied to information are encouraged and expected to challenge the 
classification level and/or control marking. 


(U) Classification challenges must follow procedures provided in Section 1.8 of EO 13526, as well as IC elements’ 
implementing procedures established in accordance with EO 13526. Control marking challenges must follow procedures 
that IC elements establish pursuant to DN/ Guidance of Intelligence Community Marking Challenges (NCIX 260-11, 
signed 18 January 2012). 


10. (U) Transmittal Documents 


(U) Unclassified or lower-classified documents such as cover letters or forms often are used to transmit classified 
attachments. The transmittal document must include a banner line with the highest overall classification level and most 
restrictive controls of any classified information attached or enclosed, along with corresponding portion markings. A 
classification authority block is encouraged but not required on unclassified transmittal documents. (Note: a classification 
authority block must appear on individual attachments, as appropriate.) When applied, the classification authority block 
must provide the required elements for the classified information that is being transmitted or enclosed, as described below 
in the Classification Authority Block section. The transmittal document must also include conspicuously on its face the 
following or similar instructions, as appropriate: “Upon removal of attachments, this document is (Classification 
Level/Applicable Conitrols).” 
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C. (U) PORTION MARKS 


(U) Per 32 CFR 2001 (ISOO Implementing Directive) and ICD 710 §D.1.g, each portion of a document (ordinarily a 
paragraph, but also subjects, titles, metadata, graphics, tables, charts, bullet statements, subparagraphs, classified 
signature blocks, bullets and other portions within slide presentations), must be marked to indicate which portions are 
classified and unclassified by placing a parenthetical symbol immediately preceding the portion to which it applies. 


(U) 32 CFR 2001 § 2001.23, Classification marking in the electronic environment, provides specific guidance regarding 
portion marking requirements for the following information categories: 


Audio/video files 

Dynamic/ad-hoc database query/report results 
Dynamic web-based content 

Instant messages/chats 


(U) Regardless of format or medium, documents containing information that requires classification and/or control 
markings, to include unclassified information with controls, must be portion marked unless a portion mark waiver has been 
granted (see below under Portion Marking Waivers). Apply classification and control markings to each portion of 
information to ensure that the information is available without unnecessary delay or restrictions. An authorized portion 
mark is listed for each classification and control marking entry in the Register. 


(U) Note: At this time, portion marking notices on text documents such as: “All portions are ([class level portion 
mark]//[control marking portion mark, if applicable]) unless marked otherwise,” are not authorized by ISOO for text-based 
information. 


(U) In cases where portions are segmented, such as in paragraphs and subparagraphs or bullets and sub-bullets: 

= If the classification level is the same for each segment, it is sufficient to put only one portion mark at the beginning 
of the main paragraph or bullet. 

= |f classification varies among segments, then portion mark each segment to avoid over classification of any one 
segment. 

= If the information contained in a subparagraph or sub-bullet is a higher level of classification than its parent 
paragraph or parent bullet, do not adjust the portion mark of the parent paragraph or bullet to bear the same level 
of classification as the subparagraph or sub-bullet. 

= Any portion, no matter what its status, is capable of determining the overall classification of the document. 

= To the extent possible, if segmented portions span more than one page, portion marks should be applied to the 
paragraphs, subparagraphs, bullets, and sub-bullets. In addition, if segmented portions stand on their own as a 
complete thought from the parent portion, consideration should be given to applying portion marks to each 
segment. 


1. (U) Syntax Rules 
(U) Follow these syntax rules when applying a portion mark: 


= Use portion marks on all classified information regardless of format or medium, unless a waiver has been 
obtained in accordance with guidance from the ISOO and P&S/IMD, per ICD 710 and applicable Intelligence 
Community Standards (ICS). 

= Portion mark all unclassified documents with dissemination control markings, regardless of format or medium, 
unless a waiver has been obtained from P&S/IMD in accordance with ICD 710 and applicable ICS. 

= Place portion marks at the beginning of the portions, immediately preceding the text to which it applies. This 
position affords maximum visibility to the reader. 

= Enclose portion marks in parentheses. 
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= Portion marks must use the same separators (i.e., slashes, hyphens, commas) as are used for the banner line, 
except for SBU NOFORN and LES NOFORN where the portion mark uses a hyphen to connect the NOFORN, 
(e.g., SBU-NF). 

= When appropriate, individual portion marks may be less restrictive than the banner line. For example: 
e Some portions of aSECRET//NOFORN document may be marked (U//FOUO), when appropriate. 
e Some portions of aSECRET//NOFORN document may be marked (S//REL TO [USA, list]), when appropriate. 


(U) For completely unclassified documents (i.e., no control markings) transmitted over a classified system, the designation 
“UNCLASSIFIED” must be conspicuously placed in the banner line. However, portion marks (i.e., “(U)”) are not required. 

When transmitting completely unclassified documents over unclassified systems, classification markings are not required. 
For hard copy documents that are completely unclassified, “UNCLASSIFIED” in the banner line is optional; portion marks 

are not required. 


2. (U) Portion Marking Waivers 


(U) The Director of ISOO may grant a waiver from portion marking. Waivers are granted for limited and specific 
categories of information. On 16 May 2014, ISOO approved the DNI’s request for IC-wide portion mark waivers through 
30 June 2017 for the following information categories: 


Complex technical, financial, or engineering diagrams, graphs, mission models, equations, and simulations 
GEOINT graphics products 

Internal forms 

President’s Daily Brief [President’s Copy] (DNI waiver only) 

Raw mission data 


(U) ISOO mandates the following requirements when using these waivers: 
= A classified document that is not portion marked cannot be used as a source for derivative classification, nor can 
it be used as a source in creation of classification guides. 
= A document for which portion markings have been waived should contain a notice stating that it may not be used 
as a source for derivative classification. 
= If aclassified document that is not portion marked is transmitted outside a unit that routinely deals with the subject 
information, the document must be portion marked. 
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D. (U) BANNER LINE 


(U) Place the banner line conspicuously at the top and bottom (header and footer) of each page, in a way that clearly 
distinguishes it from the informational text, whether in hard copy or being transmitted electronically. Each interior page of 
a classified document must have a banner line that contains either the highest level of classification and any applicable 
control markings for information contained on that page, including the designation “UNCLASSIFIED” when it is applicable, 
or the overall classification and control markings for the entire document repeated on every page. If the former method is 
used, the front page/cover must indicate the overall classification and control markings for the entire document. 


1. (U) Syntax Rules 


(U) The banner line must follow the order and syntax of the classification and control markings documented in the 
Register unless a waiver has been obtained from P&S/IMD in accordance with ICD 710 and applicable ICS. It must 
contain, at a minimum, a classification level for the information and, if required per ICD 710 §E.5, the appropriate explicit 
FD&R marking. Other control markings are to be applied only if applicable to the information. In all cases, use the lowest 
appropriate classification and least restrictive dissemination controls applicable. 


(U) Follow these syntax rules when creating a banner line: 


= The banner line must be in uppercase letters. 

= The classification level must be in English without abbreviation. 

= US classified documents must always have a banner line with a US classification marking conspicuously placed 
at the top and bottom of the outside of the front cover (if any), on the title page (if any), on the first page, and on 
the outside of the back cover (if any), unless a waiver has been obtained from P&S/IMD in accordance with ICD 
710 and applicable ICS. 

= Non-US or jointly classified documents must always begin the banner line with a double forward slash with no 
interjected space, followed by the “Non-US” or “JOINT” classification marking. 

= Only applicable control marking categories are represented in the banner line after the classification. No slashes, 
hyphens or spaces are used to hold the place of control marking categories when the control marking is not 
represented in a document. 

= Categories in the banner line are separated by a double forward slash with no interjected space (e.g., 
SECRET//NOFORN). 

= Any control markings in the banner line may be spelled out per the “Marking Title” (e.g., TALENT KEYHOLE) or 
abbreviated as per the “Authorized Abbreviation” (e.g., TK) in accordance with the Register, unless otherwise 
directed by IC element policy or procedures to use one form over the other. 

= Multiple entries may be chosen from the SCI control system, SAP, AEA information, Dissemination Control, and 
Non-Intelligence Community Dissemination Control marking categories if the entries are applicable to the 
information. If multiple entries are used within a category, list them in the order they appear in the Register 
separated by a single forward slash with no interjected space. 

= Use a hyphen to connect a marking to its sub-marking(s) within the SCI control system, SAP, and AEA 
categories. 

= Unpublished SCI and SAP markings should be listed alphanumerically along with any other applicable control 
markings. 


(U) Note: The designation “UNCLASSIFIED” must be conspicuously placed in the banner line on completely unclassified 
documents (i.e., no control markings) transmitted over a classified system. In this case, portion marks (i.e., “(U)”) are not 
required. For unclassified hard copy documents, “UNCLASSIFIED” in the banner line is optional; portion marks are not 
required. 
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2. (U) Banner Line “Roll-U 


” Rules 


(U) The banner line is developed by the “roll-up” or aggregation of portion marks. Generally, the roll-up process consists 


of: 


Taking the highest classification level of all the portions and using that as the banner line classification marking; 
except in cases of classification by compilation as described in the ISOO Implementing Directive §2001.13(c) and 
§2001.24(g). Note: Per ISOO, in cases of classification by compilation, the banner line will represent the highest 
classification and most restrictive control markings revealed by the information. The classifier must give clear 
instructions providing a reason why the information in aggregate is classified higher than its individual portions 
and also the circumstances under which the individual portions constitute a classified compilation, and when they 
do not. Follow internal departmental or agency procedures for content, location, and format of these instructions. 
Repeating in the banner line, all unique SCI, SAP, and/or AEA markings used in the portions. Note: If there are 
duplicate SCI and SAP digraphs or trigraphs values, use the SAP category indicator “//SAR-” to clearly identify the 
applicable category and ensure unique markings across the two categories. 

Using in the banner line “FGI [LIST]” where [LIST] is the one or more unique country trigraph(s) and/or 
tetragraph(s) used in the portions, when all portions have unconcealed FGI (e.g., portion marked: //GBR S); or 
using only “FGI” in the banner line, if any of the portions have concealed FGI source information (e.g., portion 
marked is: //FGI [classification level]). Note: A tetragraph is a four-letter code (unless an exception is granted) 
used to represent an international organization, alliance, or coalition. 

Repeating all unique and most restrictive IC and non-IC dissemination control markings. Table 3 below provides 
the most restrictive FD&R markings precedence rules for the banner line. For markings precedence rules of other 
dissemination control markings refer to the specific marking templates. 


Table 3: (U) FD&R Markings Precedence Rules for Banner Line Roll-Up 


(U) This table is UNCLASSIFIED. 


One or more portion(s) z z : 3 
ae contain the following FD&R Other aaah ot celta a following Overall panne line FD&R 
marking scenario ee eee marang 
1 NF Other portions have no FD&R markings NOFORN 
(Note: Not authorized on classified and 
unclassified controlled IC DAP) 
2 NF With any other FD&R marking, including: | NOFORN 
e REL TO [USA, LIST] 
e RELIDO 
e USA/[LIST] EYES ONLY 
e DISPLAY ONLY [LIST] 
Note: Only NSA is authorized to apply 
EYES ONLY; re-use requires re-marking 
as REL TO [USA, LIST]. 
3 NF SBU-NF NOFORN (IC dissem) 
4 Portions without FD&R SBU-NF NOFORN (IC dissem) 
markings 
5 Mixture of FD&R markings that | SBU-NF NOFORN (IC dissem) 
result in an overall banner line 
value of NOFORN 
6 NF LES-NF NOFORN (IC dissem) 
7 Portions without FD&R LES-NF NOFORN (IC dissem) 
markings 
8 Mixture of FD&R markings that | LES-NF NOFORN (IC dissem) 
result in an overall banner line 
value of NOFORN 
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Rule Uie onare pomonte) Other portion(s) contain the following Overall banner line FD&R 

# comam me oring Fea marking scenario marking 

marking scenario 

9 REL TO [USA, LIST] REL TO [USA, LIST] NOFORN 
(with no common [LIST] value(s) 
amongst the portions) 

10 REL TO [USA, LIST] RELIDO NOFORN 

11 REL TO [USA, LIST] DISPLAY ONLY [LIST] NOFORN 
(with no common [LIST] value(s) 
amongst the portions) 

12 REL TO [USA, LIST]//RELIDO | Other portions have no FD&R markings NOFORN 

13 REL TO [USA, LIST] USA/[LIST] EYES ONLY NOFORN 
(with no common [LIST] value(s) 
amongst the portions) 

Note: Only NSA is authorized to apply 
EYES ONLY; re-use requires re-marking 
as REL TO [USA, LIST]. 

14 REL TO [USA, LIST] SBU-NF NOFORN (IC dissem) 

15 REL TO [USA, LIST] LES-NF NOFORN (IC dissem) 

16 REL TO [USA, LIST] Other portions have no FD&R markings NOFORN 

17 RELIDO Other portions have no FD&R markings NOFORN or RELIDO (depends 
on origination date and non- 
FD&R caveats, if any — see 
Section B.3., Table 2, FD&R 
Markings Summary) 

18 RELIDO DISPLAY ONLY [LIST] NOFORN 

19 DISPLAY ONLY [LIST] Other portions have no FD&R markings NOFORN 

20 DISPLAY ONLY [LIST] DISPLAY ONLY [LIST] NOFORN 
(with no common [LIST] value(s) 
amongst portions) 

21 REL TO [USA, LIST] REL TO [USA, LIST] REL TO [USA, LIST] (common 
trigraph/tetragraph code(s) only 
in banner line [LIST]) 

22 REL TO [USA, LIST] USA/[LIST] EYES ONLY REL TO [USA, LIST] (common 
(with at least one common [LIST] trigraph/tetragraphs only in 
value(s) amongst portions) banner line [LIST]) 

Note: Only NSA is authorized to apply 

EYES ONLY; re-use requires re-marking 

as REL TO [USA, LIST]. 

23 REL TO USA, TEYE or ACGU | REL TO [USA, LIST] REL TO [USA, LIST] 
or FVEY (Expansion of the TEYE, 

ACGU, and FVEY tetragraphs is 
allowed for common country 
roll-up of banner line REL TO 
[USA, LIST] marking) 

24 RELIDO RELIDO RELIDO 

25 DISPLAY ONLY [LIST] DISPLAY ONLY [LIST] DISPLAY ONLY [LIST] 

(with at least one common [LIST] (common trigraph/tetragraphs 
value(s) amongst portions) only in banner line [LIST]) 
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One or more portion(s) 7 7 7 z 
pi contain the following FD&R Other porion anan a following Overall auc line FD&R 
marking scenario adele eanlclte eee 
26 DISPLAY ONLY [LIST] REL TO [USA, LIST] DISPLAY ONLY [LIST] 
(with at least one common [LIST] (common trigraph/tetragraphs 
value(s) amongst portions) only in banner line [LIST]). 
Note: This roll-up reflects IC 
FD&R concept that if 
information is approved for 
release to a given audience it 
has automatically been 
approved for disclosure to that 
audience. 
27 REL TO [USA, LIST]/DISPLAY | REL TO [USA, LIST]/DISPLAY ONLY REL TO [USA, LIST//DISPLAY 
ONLY [LIST] [LIST] ONLY [LIST] 
(with at least one common [LIST] 
value(s) amongst all REL TO portions 
and at least one common [LIST] value 
amongst all DISPLAY ONLY portions or 
DISPLAY ONLY and REL TO portions.) 
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E. (U) CLASSIFICATION AUTHORITY BLOCK 


(U) In accordance with EO 13526, 32 CFR Part 2001, and ICD 710, §D.2, when a classification determination is made, 
the information must be marked with several elements regarding the determination to indicate: the person responsible for 
the classification determination, the reason for classification (only used on original classification decisions), the authority 
for the classification determination, and the declassification instructions. Combined, these elements are referred to as the 
classification authority block. The classification authority block must appear on the face of all US classified National 
Security Information (NSI) documents. 


(U) There are two types of classification authority: Original Classification Authority (OCA) and derivative classification 
authority. 


1. (U) Original Classification Authority 


(U) An OCA classification decision is the act of initially determining that unauthorized disclosure of information reasonably 
could be expected to result in damage to the national security. On the face of all originally classified documents, 
regardless of the media, the OCA must apply the following classification authority block markings (EO 13526, ISOO 
Implementing Directive, §2001.21 and §2001.26, and ICD 710, §D.2): 


= Classified By: Identification by name and position or personal identifier of the OCA. 

= Agency and Office of Origin: If not otherwise evident, the agency and office of origin must be identified and 
follow the name on the “Classified By” line. 

= Classification Reason: Concise reason for classification that cites at least one of the classification categories 

listed in EO 13526, §1.4. 
= Declassify On: Duration of the original classification decision, specified as the single date, event, or exemption, 

e.g., 25X1 means using exemption category “1” to prevent automatic declassification at 25 years that corresponds 

to the lapse of the information’s national security sensitivity. Valid values include: 

e Adate of no more than 25 years from the original classification decision or the information's origin. The 

following format must be used: YYYYMMDD 

e An event. Events must be reasonably definite, foreseeable, and less than 10 years in the future. 

e “50X1-HUM” marking used when the information clearly and demonstrably could reveal a confidential human 

source or a human intelligence source. 

e “50X2-WMD” marking used when the information clearly and demonstrably could reveal key design concepts 

of weapons of mass destruction. 

e Use “Current date plus 25 years” in YYYYMMDD format for imagery products produced from space-based 
ISR systems, as outlined in NGA GEOINT Classification Guide. Use of 25X1, EO 12951 is reserved 
exclusively for D/NGA in classifying original imagery only. See DNI ES 2014-00696 dated 12 November 2014 
for details. 

An exemption category of “25X#, date or event” (where “#” is a number from 1-9), see Note. 

An exemption category of “SOX#, date or event” (where “#” is a number from 1-9), see Note. 

An exemption category of “75X#, date or event” (where “#” is number from 1 -9), see Note. 

"N/A to [RD/FRD/TFNI, as appropriate] portions. See source list for NSI portions." Used when classified NSI 
includes RD, FRD, and/or TFNI portions. See ISOO Notice 2011-02. 

e "N/A to NATO portions. See source list for NSI portions." Used when classified NSI includes NATO portions. 

See ISOO Notice 2013-01 for additional guidance. 

e "N/A to [RD/FRD/TFNI, as appropriate] [and NATO, if appropriate] portions. See source list for NSI portions." 

Used when classified NSI includes RD, FRD, and/or TFNI portions and NATO portions. See ISOO Notice 

2013-01 for additional guidance. 


(U) Note: The use of exemptions from automatic declassification by agencies must be authorized in accordance with 
ISOO Implementing Directive, §2001.26. In addition, §2001.26(a)(6) states: "The marking ‘subject to treaty or international 
agreement is not to be used at any time.” 
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2. (U) Derivative Classification Authority 


(U) Derivative classification is the act of incorporating, paraphrasing, restating, or generating in new form any information 
that is already determined to be classified by an OCA either in a source document, classification guide, or other OCA 
guidance document. Unless superseded by OCA guidance, a derivative classifier should observe and respect the original 
classification decision, and carry forward to any newly created document the pertinent classification and control markings 
from the source document(s), classification guide(s), or other applicable OCA guidance. 


(U) Derivative classifiers are responsible for appropriately classifying and marking information. The face of all derivatively 
classified documents must carry all markings prescribed in ISOO Implementing Directive §2001.20 and §2001.21. Provide 
information for the classification authority block (ISOO Implementing Directive, §2001.22 and ICD 710, §D.2): 


= Classified By: Cite the derivative classifier’s identification by name and position, or by personal identifier, in a 
manner that is immediately apparent on each derivatively classified document. If not otherwise evident, the 
agency and office of origin must be identified and follow the name on the “Classified By” line. 

= Derived From: Concisely identify the source document or the classification guide on the “Derived From” line, 
including the agency and, where available, the office of origin and the date of the source or guide used for the 
classification determination. 

= Declassify On: Cite the single date, event, or exemption value that corresponds to the lapse of the information’s 
national security sensitivity either carried forward from the source document's “Declassify On” line or from the 
applicable classification guide. Only a single value must be used on the “Declassify On” line of the classification 
authority block. If a classification guide specifies multiple 25-year exemptions with the same date or event for the 
same information element, select the exemption with the lowest number for the “Declassify On” line. 


(U) In addition to portion marks, classification banners, and a classification authority block, ISOO also requires the date of 
origin of the document to be indicated for all classified documents (regardless of medium). Note: The “Classification 
Reason’ is not transferred from originally classified source(s) documents or guide(s) in a derivative classification action. 


Individuals who think information they possess is inappropriately classified are expected to bring their concerns to 
responsible classification management official(s) within their organization. 


3. (U) Multiple Sources and the Declassify On Line Hierarchy 


(U) Use “Multiple Sources” as the “Derived From” value when a document is classified derivatively based on more than 
one source document, classification guide, or element of a classification guide(s). The “Declassify On” line must reflect 
the single declassification value that provides the longest classification duration of any of the sources. When determining 
the single most restrictive declassification instruction among multiple source documents, adhere to the following hierarchy 
for determining the declassification instruction: 


= "N/A to [RD/FRD/TFNI, as appropriate] [and NATO, if appropriate] portions. See source list for NSI portions." 
Note: per related ISOO Notice 2011-02 and 2013-01, these values do not have a date or event associated with 
them. Any one or combination of these declassification instructions takes precedence over all other 
declassification instructions. Recipients are to use the source list for declassification instructions for each 
classified NSI source. 

= “50X1-HUM” or “50X2-WMD?” or an ISOO-approved designator reflecting the ISCAP approval for classification 
beyond 50 years. If the source documents have both 50X1-HUM and 50X2-WMD exemptions, apply 50X1-HUM 
as the exemption with the lowest number. Note: Per ISOO Notice 2012-02, “25X1-human’” is no longer 
authorized; “50X1-HUM” replaces it. 

= 50X1 — 50X9, with a date or event. If the source documents or classification guide(s) element(s) have multiple 
50X exemptions, apply the exemption with the date or event that provides the longest period of protection. If all 
“50X#, date or event” exemptions have the same date or event, apply the “50X#, date/event” exemption with the 
lowest number. 
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= “25X1, EO 12951” Note: Per DNI Memo ES 2014-00696, dated 12 November 2014, the 25X1, EO 12951 value is 
reserved exclusively for D/NGA in classifying original imagery only. 

= 25X1 through 25X9, with a date or event. If the derivative source(s) have multiple 25X exemptions, apply the 
exemption with the date or event that provides the longest period of protection. If all “25X#, date or event” 
exemptions have the same date or event, apply the single “25X#, date/event” exemption with the lowest number. 

= 25X1 through 25X9 without a date or event. If the derivative source document(s) have 25X# exemption(s) 
without a date or event, determine the longest period of protection by calculating a 50-year date from the source 
document date. If the source document date cannot be readily determined, calculate a date 50 years from the 
current date. If all 25X#s with a calculated 50-year date have the same date, apply the single exemption with the 
lowest number and the calculated 50-year date. 

= A specific declassification date no more than 25 years in the future. 

= An event less than 10 years in the future. 

= Absent guidance from an original classification authority with jurisdiction over the information, a calculated 25- 
year date from the date of the source information. When the source date cannot be readily determined, calculate 
a date 25 years from the current date. 


(U) When the “Derived From” value is “Multiple Sources’, the derivative classifier must include a listing of all source 
materials on or attached to each derivatively classified document. The list of sources is intended to facilitate future 
declassification reviews. 


4. (U) Commingling Classified National Security Information (NSI) and Atomic Energy Act 
Information 


(U) When a derivatively classified NSI document contains portions of Restricted Data (RD), Formerly Restricted Data 
(FRD), or Transclassified Foreign Nuclear Information (TFNI), the “Declassify On” line must not contain a declassification 
date or event. The following must be annotated on the “Declassify On” line: “N/A to [RD/FRD/TFNI, as appropriate] 
portions” and “See source list for NSI portions” separated by a period. The NSI source list, as described in ISOO 
Implementing Directive, §2001.22(c)(1)(ii), must include the declassification instruction for each of the source documents 
classified under EO 13526. This source list must not appear on the front page in the case of a commingled document as 
noted in the ISOO Implementing Directive, §2001.24(h)(3). 


(U) In the case of a single page document that commingles RD or FRD and classified NSI, or in the case of a single page 
document that commingles TFNI and classified NSI, the NSI source list may appear at the bottom of the document below 
and clearly identified as separate from the classification authority block. This NSI source list will display the appropriate 
declassification instructions for each source. The “Declassify On” line will read “N/A to [RD/FRD/TFNI, as appropriate] 
portions. See source list for NSI portions.” 


5. (U) Commingling Classified NSI and NATO Information 


(U) When a derivatively classified NSI document contains portions of North Atlantic Treaty Organization (NATO) 
information, the “Declassify On” line must not contain a declassification date or event. The following must be annotated 
on the “Declassify On” line: “N/A to NATO portions. See source list for NSI portions.” The NSI source list must include 
the declassification instruction for each of the source documents classified under EO 13526. 


6. (U) Retired or Invalid Declassify On Values 


(U) When using a source document or classification guide to derivatively classify information, where the “Declassify On” 
value(s) have been either retired or declared invalid by ISOO, the ISOO Implementing Directive provides the following 
guidance: 


= “Originating Agency’s Determination Required”, “OADR’”, or “Source Marked OADR, date of source [value]” 
e The derivative classifier must calculate a date that is 25 years from the date of the source document (see 
Note.) 
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e When the source date cannot be readily determined, calculate a date 25 years from the current date. 


= “Manual Review’, “MR”, or “Source Marked MR, date of source [value]” 
e The derivative classifier must calculate a date that is 25 years from the date of the source document (see 
Note.) 
e When the source date cannot be readily determined, calculate a date 25 years from the current date. 


= Exemption markings “X1”, “X2”, “X3”, “X4”, “X5”, “X6”, “X7”, and “X8” or “Source Marked X1-X8, date of source 


[value]” 
e The derivative classifier must calculate a date that is 25 years from the date of the source document (see 
Note.) 


e When the source date cannot be readily determined, calculate a date 25 years from the current date. 


= “DNI Only” or “DCI Only” 
e Calculate a 25 year date or the appropriate 25X exemption from the source document. If the source 
document contains no classification authority block information, calculate a 25 year date. 
= “Subject to treaty or international agreement” 
e The derivative classifier must refer to the applicable OCA guidance regarding use of an authorized exemption, 
if any; absent guidance from an OCA, the derivative classifier must calculate a date that is 25 years from the 
date of the source document. 


= “25X1-human” 
e The derivative classifier must not carry forward the 25X1-human declassification instruction from the 
source document; but instead, derivative classifiers should use the “50X1-HUM” marking. 


= Exemption markings “25X1”, “25X2”, “25X3”, “25X4”, “25X5”, “25X6”, “25X7”, “25X8” and “25X9” without the 
required date or event, or “Source Marked 25X1-25X9, date of source [value] 
e The derivative classifier must calculate a date that is 50 years from the date of the source document. 
e When the source date cannot be readily determined, calculate a date 50 years from the current date. 


Notes: 


(U) A derivative classifier should not assume the information is unclassified if the calculated 25-year date has passed. 
The derivative classifier should contact the originating agency for guidance regarding an appropriate declassification 
instruction for that information. 


(U) The guidance provided in this section is paraphrased from EO 13526, the Implementing Directive, and other ISOO 
guidance. Should there be any discrepancies between this Manual and EO 13526 or ISOO guidance, the EO 13526 and 
ISOO guidance will take precedence until the Manual is updated. For more information on the classification authority 
block, refer to EO 13526 and the ISOO Implementing Directive, Subparts A-C, and ICD 710, §D.2. 
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F. (U) Legacy Control Markings 


(U) Information bearing legacy control markings and/or information security metadata (if any), including applicable parts of 
the classification banner, portion marks, and classification authority block, is required to be re-marked in accordance with 
the current Register and Manual under either of the following conditions: 


1.(U) When disseminated and the access rights and handling assigned to the legacy-marked information will not 
appropriately control access to the information; or 


2. (U) When the legacy-marked information is reused. 


(U) Re-marking is not required when legacy-marked information is retained within the access control mechanisms that 
protect and enforce the access rights and handling assigned to the legacy-marked information. 


(U) As identified, legacy markings will be incorporated into the Unauthorized IC Classification and Control Markings List. 

It will include guidance on how legacy markings should be changed to comply with current standards and requirements for 
access to and protection of such information. If no mapping exists for a specific legacy marking, contact your agency’s 
CMIWG representative for assistance. 


(U) Definitions (for the purposes of this document): 


= (U) Legacy control markings: Unauthorized IC and non-IC control markings. 

= (U) Dissemination: shared externally or internally with the holding agency or moved into a new information 
resource. 

= (U) Information resource: any aid that provides information and imparts knowledge (e.g., a repository, system, 
database, publication, conference listing, or the Internet). 

= (U) Reuse: incorporated, paraphrased, restated, revised, or reintroduced into a new document or information 
resource. 

= (U) Document: any recorded information, regardless of the nature of the medium or the method or circumstances 
of recording. 


(U) The Unauthorized IC Classification and Control Markings list (not exhaustive) is available on the SMP Intelink-TS 
website and is updated as unauthorized markings are identified. The list contains the following items: 


= IC element internal markings not authorized for information transmitted outside of the IC element 

= Legacy markings no longer authorized for intelligence information 

=  Non-IC markings not authorized for use on intelligence information (Note: markings are authorized only for non-IC 
information) 

= Other unauthorized markings 


U) The SMP Intelink-TS URL for the Unauthorized IC Classification and Control Markings list is: 
(b)(3) 50 U.S.C. 30241 For additional information, 


questions, or comments on unauthorized markings, please contact the SMP office (b)(3) 50 U.S.C. 30241 
(6)(3) 50 U.S.C. 30241 
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G. (U) IC Markings System Register 
1. (U) Registered Markings 


(U) The Register provides the list of authorized classification and control markings for the IC. To promote information 
sharing and identify and protect non-US, NATO, and USG non-IC elements’ information, the Register also includes 
markings used on foreign and non-IC information authorized by the DNI to be received and used within the IC and on the 
Information Technology Enterprise (IC ITE) and legacy systems. For more information on these markings refer to the 
respective markings categories and templates in the Manual. 


(U) All markings used in a banner line and portion mark must be in accordance with the values listed in the Register, 
unless a waiver has been obtained from P&S/IMD in accordance with ICD 710 and applicable ICS, and follow the order in 
which they appear in this list. Refer to the corresponding marking section in the Manual for specific marking instructions 
and guidance (e.g., banner line and portion mark formatting and syntax). 


(U) To consistently apply DNI guidance, promptly report any marking conflicts or new markings to your agency’s CMIWG 
representative. A list of unauthorized markings is maintained by SMP and available on the SMP’s JWICS website. 


Table 4: (U) Register of Authorized Classification and Control Markings 
(U) This table is UNCLASSIFIED. 


Authorized Banner Line Marking Title Authorized Banner Authorized Portion Mark 


Line Abbreviation 
1. US Classification Markings 


TOP SECRET None 


SECRET None 


CONFIDENTIAL None 


clololz 


UNCLASSIFIED None 


2. Non-US Protective Markings 


Non-US Protective Markings, refer to Appendix A 


Non-US Classification Markings 


See Appendix A Section 1 Guidance 


Non-US Special Access Program Markings 


See Appendix A Section 2 Guidance 


Non-US Dissemination Control Markings 


See Appendix A Section 3 Guidance 


Five Eyes Protective Marking Comparisons 


See Appendix A Section 4 Guidance 


NATO Protective Markings, refer to Appendix B 


NATO Classification Markings 


COSMIC TOP SECRET None CTS 


NATO SECRET None NS 


NATO CONFIDENTIAL None NC 


NATO RESTRICTED None NR 


NATO UNCLASSIFIED None NU 
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Authorized Banner Line Marking Title 


NATO/NAC Markings, refer to Appendix B, Sect. 2 


Authorized Banner 
Line Abbreviation 


Authorized Portion Mark 


239 


[SUB-COMPARTMENT] 


NATO [NAC Activity] SECRET None N[NAC Activity]S 
NATO [NAC Activity] CONFIDENTIAL None N[NAC Activity]C 
NATO [NAC Activity] RESTRICTED None N[NAC Activity]JR 
NATO [NAC Activity] UNCLASSIFIED None N[NAC Activity]U 
NATO Special Access Program Markings 
ATOMAL None ATOMAL 
BALK None BALK 
BOHEMIA None BOHEMIA 
NATO Dissemination Control Markings 
See NATO Appendix B, Sect. 4 
United Nations (UN) Protective Markings, refer to 
Appendix C 
UN RESTRICTED None None 
3. JOINT Classification Markings (US is Co-Owner) 
JOINT TOP SECRET [LIST]* None JOINT TS [LIST] 
JOINT SECRET [LIST] None JOINT S [LIST] 
JOINT CONFIDENTIAL [LIST] None JOINT C [LIST] 
JOINT UNCLASSIFIED [LIST] None JOINT U [LIST] 
4. SCI Control System Markings 
HCS (requires the associated compartment) HCS HCS 
O O O 
P P P 
[SUB-COMPARTMENT] (up to 6 characters) XXXXXX P XXXXXX 
RESERVE (requires the associated compartment) RSV RSV 
[COMPARTMENT] (up to 3 characters) XXX XXX 
SI SI SI 
[COMPARTMENT] XXX XXX 
ECRU EU EU 
GAMMA G G 
GAMMA [SUB-COMPARTMENT] (4 characters) XXXX XXXX 
NONBOOK NK NK 
TALENT KEYHOLE TK TK 
BLUEFISH BLFH BLFH 
[SUB-COMPARTMENT] (up to 6 characters) XXXXXX XXXXXX 
IDITAROD IDIT IDIT 
[SUB-COMPARTMENT] XXXXXX XXXXXX 
KANDIK KAND KAND 
XXXXXX XXXXXX 


5. Special Access Program Markings 


SPECIAL ACCESS REQUIRED-[PROGRAM IDENTIFIER] 


SAR-[PROGRAM 
IDENTIFIER] or SAR- 


(SAR-[PROGRAM 
IDENTIFIER abbreviation]) 


[PROGRAM 
IDENTIFIER 
abbreviation] 
6. Atomic Energy Act Information Markings 
RESTRICTED DATA RD RD 
CRITICAL NUCLEAR WEAPON DESIGN INFORMATION CNWDI CNWDI 
SIGMA [#] SIGMA [#] SG [#] 
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FORMERLY RESTRICTED DATA FRD FRD 
SIGMA [#] SIGMA [#] SG [#] 
DOD UNCLASSIFIED CONTROLLED NUCLEAR DOD UCNI DCNI 
INFORMATION 
DOE UNCLASSIFIED CONTROLLED NUCLEAR DOE UCNI UCNI 
INFORMATION 
TRANSCLASSIFIED FOREIGN NUCLEAR INFORMATION TFNI TFNI 
7. Foreign Government Information Markings 
FOREIGN GOVERNMENT INFORMATION or FGI or [LIST] [non-US 
FOREIGN GOVERNMENT INFORMATION [LIST]* FGI [LIST] classification 
portion mark] 
(Note: This category is used when US classifiers derivatively or 
source foreign government marked information in US NATO portion 
products.) mark 
or 
FGI [non-US classification 
portion mark] 
Special Access Program Markings 
Refer to section H.5 
Dissemination Control Markings 
Refer to section H.8 
8. Dissemination Control Markings 
RISK SENSITIVE RSEN RS 
FOR OFFICIAL USE ONLY FOUO FOUO 
ORIGINATOR CONTROLLED ORCON OC 
ORIGINATOR CONTROLLED-USGOV ORCON-USGOV OC-USGOV 
CONTROLLED IMAGERY IMCON IMC 
NOT RELEASABLE TO FOREIGN NATIONALS NOFORN NF 
CAUTION-PROPRIETARY INFORMATION INVOLVED PROPIN PR 
AUTHORIZED FOR RELEASE TO [USA, LIST]** REL TO [USA, LIST] REL TO [USA, LIST] or 
REL 
RELEASABLE BY INFORMATION DISCLOSURE OFFICIAL RELIDO RELIDO 
USA/[LIST]* EYES ONLY (Note: Only authorized for use on None USA/[LIST] EYES ONLY or 
NSA SIGINT reporting, waivered through 01 October 2017. EYES 
DEA SENSITIVE None DSEN 
FOREIGN INTELLIGENCE SURVEILLANCE ACT FISA FISA 


DISPLAY ONLY [LIST]* 


DISPLAY ONLY [LIST] 


DISPLAY ONLY [LIST] 


9. Non-Intelligence Community Dissemination Control Markings 


LIMITED DISTRIBUTION LIMDIS DS 
EXCLUSIVE DISTRIBUTION EXDIS XD 
NO DISTRIBUTION NODIS ND 
SENSITIVE BUT UNCLASSIFIED SBU SBU 
SENSITIVE BUT UNCLASSIFIED NOFORN SBU NOFORN SBU-NF 
LAW ENFORCEMENT SENSITIVE LES LES 
LAW ENFORCEMENT SENSITIVE NOFORN LES NOFORN LES-NF 
SENSITIVE SECURITY INFORMATION SSI SSI 


UNCLASSIFIED//F%e— 


(U) * “ILIST]” pertains to one or more Register, Annex B trigraph country codes or Register, Annex A tetragraph code(s), 
or Manual, Appendix B NATO/NAC markings used with the Non-US, JOINT, FGI, EYES ONLY (for Second Party Partners 
only), or DISPLAY ONLY markings. A tetragraph is a four-letter code (unless an exception is granted) used to represent 
an international organization, alliance, or coalition. Refer to the specific marking template in the Manual for “[LIST]” 
formatting and syntax guidance. 
(U) ** “IUSA, LIST]’ pertains to the string that contains “USA” followed by one or more Register, Annex B trigraph country 
code(s), Register, Annex A tetragraph code(s), or Manual, Appendix BNATO/NAC markings used with the REL TO 
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marking. A tetragraph is a four-letter code (unless an exception is granted) used to represent an international 
organization, alliance, or coalition. “USA” must always appear first whenever the REL TO string is used to communicate 
release decisions either by the US or a Non-US entity. Refer to the REL TO marking template in Section H.8 for “[LIST]” 
formatting and syntax guidance. 


(U) IC Markings System Register Annexes 
= Register Annex A — Tetragraph Codes (U//FOUO Version) 
= Register Annex B- Trigraph Country Codes 


2. (U) Registered Markings Access Rights and Handling (ARH) 


(U) Application of classification and control markings, impacts dissemination, discovery, and retrieval of that information. 
This section provides the conceptual access requirements for information marked with one or more authorized 
classification and control markings regardless of media (i.e., hardcopy and electronic.). These requirements will be one 
component used by IC automated systems in the IC Information Technology Enterprise (IC ITE) to make access control 
decisions for electronic information. The Information Security Markings Access Control Encoding Specification 
(ISM.ACES) provides the framework for systems to enforce access requirements based on the classification and/or 
control markings applied. 


(U) The classification marking on data always influences determinations regarding user and system access, as it reflects 
whether and at what level a clearance is required for a user (i.e., entity) to have for access. However, all control markings 
do not similarly impact access determinations. Some are only applied to alert recipients to handling or safeguarding 
requirements for information reuse or further sharing. Examples of this type of content indicator include the FGI, and 
RSEN markings. These markings do not impact access to data transmitted or stored on a controlled network such as the 
Joint Worldwide Intelligence Communications System (Intelink-TS), Secret Internet Protocol Router Network (Intelink-S), 
or the Non-secure Internet Protocol Router Network (NIPRNet). 


(U) Table 5 below summarizes the unique “known” conceptual ARH for each registered marking. ARH requirements for 
control markings that are validated through ARH requirements of other markings also present, i.e., classification marking, 
are not repeated for each control marking. For example, access to HCS-P requires a clearance regardless of the 
classification marking for the data and a read-in for HCS-P access; but, only the unique requirement of HCS-P read-in is 
listed in the HCS-P row of Table 5. The access criteria related to security clearance level for other than SCI is met as part 
of the applicable US Classification Markings’ ARH requirement and is not repeated in the table for each marking. 


(U) The contents of Table 5 will evolve as additional ARH requirements are identified for existing markings or if new 
markings are added to the IC Markings System. The technical (i.e., machine-readable) implementation of these 


conceptual ARH rules is found in the current version of the ISM.ACES technical specification available on IC ClO’s 
Intelink-TS website (QJ@)UIRSKemeeezi 


(U) The “Entity (User) Attributes” for all markings in Table 5 may be expanded to include a country affiliation and 
corresponding organizational affiliation of one or more foreign entities included in the [LIST], if one or more of the following 
foreign disclosure and release markings is also present: REL TO USA, [LIST], USA/[LIST] EYES ONLY (only authorized 
for use on NSA SIGINT reporting as waivered by the NCSC and IC CIO), or DISPLAY ONLY [LIST] markings. 


(U) Access by foreign entities to classified US intelligence information requires a positive foreign disclosure and release 
determination in accordance with ICD 403 and application of the appropriate FD&R marking(s) (i.e., REL TO, EYES 
ONLY, or DISPLAY ONLY). When no FD&R marking is present, the information is treated as NOFORN or RELIDO 
(depending on the date of origin) and access is restricted to users with a US clearance and “USA” country affiliation. 
Marking and handling requirements for unclassified US intelligence information are detailed in the last three rows of Table 
2 (U) FD&R Markings Summary. 


(U) In addition to country affiliation expressed as a trigraph country code from Annex B, IC ITE users will also have an 
organizational affiliation to track either the US federal government department or agency they support, or the state, local, 
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tribal, territorial (SLTT) government entity they support. In IC ITE, foreign users will have an organizational affiliation to 
track the US or foreign governmental agency they support. This value is not relevant to an access control determination 
unless a foreign disclosure and release marking is also present (i.e., REL TO, EYES ONLY, or DISPLAY ONLY). The 
capacity or role in which users support these organizations is expressed as one of the following: staff, contractor, civilian, 


or military. 


(U) Finally, access to classified information requires a need-to-know determination, dependent on Federal Regulation. For 
NSI, refer to 32 CFR Parts 2001 and 2003, Section 2001.40. For AEA Information, refer to 10 CFR 1045, Section 1045.3. 


Table 5: (U) Conceptual Access Rights and Handling (ARH) by Registered Marking 


(U) Table is UNCLASSIFIED//FOUO. 
Marking/Data Attribute 


Impacts 
ARH Y/N 


Y 
Y 
Y 
Y 
Y 
Y 
Y 
Y 
Y 
Y 


1. US Classification Markings 


2. Non-US Protective Markings 


Non-US Classification Markings 


Non-US Special Access Program 
Markings (SCI, SAP, AEA) 


Non-US Dissemination Control 
Markings 


Five Eyes Protective Markings 


NATO Protective Markings 
NATO Classification Markings (C, S, 
TS) 


NATO RESTRICTED 


Entity (User) Attribute 


Requires clearance level of Top Secret 


Requires clearance level of Secret or higher 
Requires clearance level of Confidential or higher 


Requires organizational affiliation of US federal or 
SLTT government 


Requires clearance level at or above Non-US 
classification marking 


Requires US SCI, SAP, or AEA program 
read-in, when the non-US marking is the 
same as a US SCI, SAP, or AEA marking 

If no US equivalent, contact the US 
originator/responsible agency for the non-US 
information for guidance 


Requires US equivalent ARH, when the non- 
US marking is the same as a US marking 
(i.e., ORCON or REL TO) 

If no US equivalent, contact the US 
originator/responsible agency for the non-US 
information for guidance 


Requires clearance level at or above FVEY 
classification marking, and 

Requires FVEY affiliation (i.e., AUS, CAN, 
GBR, NZL, or USA) 


Requires NATO read-in, and 

Requires clearance level issued by country of 
affiliation at or above NATO classification 
marking 


Requires NATO read-in 


NATO UNCLASSIFIED Y Requires organizational affiliation of US federal or 
SLTT government 
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Marking/Data Attribute 


NATO/NAC Markings (C, S, TS) 


NATO/NAC RESTRICTED 


NATO/NAC UNCLASSIFIED 


NATO Dissemination Control Markings 


UNCLASS 


Impacts 
ARH Y/N 


United Nations (UN) Protective Markings 


UN RESTRICTED Requires clearance level of Confidential or higher 


3. JOINT Classification Markings (US is 
JOINT TOP SECRET [LIST] 


JOINT SECRET [LIST] 


JOINT CONFIDENTIAL [LIST] 


JOINT UNCLASSIFIED [LIST] 


Co-Owner) 


IFIED// F66- 


Entity (User) Attribute 


Requires NATO read-in, and 
Requires clearance level at or above 
NATO/NAC classification marking 


Note: NAC activity names and members are not 
registered. 
Requires NATO read-in 


Note: NAC activity names and members are not 
registered. 
Requires organizational affiliation of US 
federal or SLTT government 


Note: NAC activity names and members are not 
registered. 


Requires ATOMAL read-in 
Requires BALK read-in 
Requires BOHEMIA read-in 


ORCON See US ORCON ARH requirements 
RELEASEABLE TO or [LIST] ONLY See US REL TO ARH requirements 


Requires Top Secret clearance, and 
Requires affiliation with at least one value in 
the [LIST] 

Requires clearance at or above Secret, and 
Requires affiliation with at least one value in 
the [LIST] 

Requires clearance at or above Confidential, 
and 

Requires affiliation with at least one value in 
the [LIST] 

Requires organizational affiliation of US 
federal government, or 

Requires affiliation with at least one value in 
the [LIST] 


4. SCI Control System Markings (Requires Top Secret clearance for all data classification levels) 


OPERATIONS 


PRODUCT 


PRODUCT [SUB- 
COMPARTMENT] 


RESERVE 


HCS-P read-in 
Requires HCS-O read-in 
Requires HCS-P read-in 


Requires HCS-P [sub-compartment] read-in 


RSV is not used alone, requires compartment 
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Marking/Data Attribute Impacts Entity (User) Attribute 
ARH Y/N 


Y Requires RSV-[compartment] read-in and 
additional user and system accreditation — 

contact the program manager for guidance 

Y__| Requires SI read-in. _ S 
Requires SI-[COMPARTMENT] read-in and 
additional user and system accreditation — 

contact the program manager for guidance 
Requires SI-ECRU and SI-NONBOOK read-in as 
well as additional user and system accreditation — 
contact the program manager for guidance 

Y__| Requires Sl-Greadin __ S o 
Requires SI-G [sub-compartment] read-in and 
additional user and system accreditation — 

contact the program manager for guidance 
Requires SI-NONBOOK read-in and additional 
user and system accreditation — contact the 
program manager for guidance 

Y | RequiresTKreadin S 
Y__| Requires TK-BLFH readin __ _  — 
Requires TK-BLFH [sub-compartment] read-in 

and additional user and system accreditation — 
contact the program manager for guidance 


Y__ | Requires TK-IDIT read-iù _  — | 
Requires TK-IDIT [sub-compartment] read-in and 
additional user and system accreditation — 

contact the program manager for guidance 

Y___ | Requires TK-KAND read-iùn _ 
Requires TK-KAND [sub-compartment] read-in 
and additional user and system accreditation — 
contact the program manager for guidance 


RESERVE-[COMPARTMENT] 


n 


SI-[COMPARTMENT] 


SI-ECRU 


GAMMA 
GAMMA [SUB- 
COMPARTMENT] 


SI-NONBOOK 


TALENT KEYHOLE 
BLUEFISH 
BLFH-[SUB- 
COMPARTMENT] 


IDITAROD 
IDIT-[SUB- 
COMPARTMENT] 


KANDIK 
KAND-[SUB- 
COMPARTMENT] 


E 
Ba 
DE 
E 
DE 
DE 
D 
E 
DE 
Oy o 
DE 
OY 
DE 


5. Special Access Program Markings 
SPECIAL ACCESS REQUIRED- 
[PROGRAM IDENTIFIER] 


Requires SAR-[PROGRAM-IDENTIFIER] read-in 
and additional user and system accreditation — 
contact the originator/DoD program manager for 
guidance 


E 


6. Atomic Energy Act Information Markings 


RESTRICTED DATA Y Requires Q clearance 


CNWDI Y e Requires Q access, and 
e Requires CNWDI read-in 

Note: For DoD personnel, including all DoD IC 

element personnel, a Q access is not required 


SIGMA [#] Y e Requires Q access and 
e Requires SIGMA [#] read-in 


FRD N The presence of FRD does not impact ARH 
Note: Foreign disclosure and release 
determination requires prior approval by DOE 
(i.e., treat as NOFORN until approval is received, 
if received mark as REL TO.) 
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Marking/Data Attribute Impacts Entity (User) Attribute 
ARH Y/N 


SIGMA [#] Y e Requires Q access, and 
e Requires SIGMA [#] read-in 


DOD UCNI Y e Requires organizational affiliation of US 
federal government, or 
e Requires organizational affiliation of US SLTT 
government with staff role (i.e., contractors 
are not authorized) 
Note: USA country affiliation is not required 
DOE UCNI Requires organizational affiliation of US 
federal government, or 
Requires organizational affiliation of US SLTT 
government with a staff role (i.e., contractors 
are not authorized) 
Note: USA country affiliation is not required 


TFNI _— The presence of TFNI does not impact ARH 


7. ee ae Government Information 
ee ae 


FGI Miama en | The presence of FGI does not impact ARH 


FGI [LIST] Y/N e The presence of FGI [LIST] with NATO in the 
[LIST] requires NATO read-in 
e The presence of FGI [LIST] without NATO in 
the [LIST] does not impact ARH 


8. Dissemination Control Markings ee | | nT a See 
RSEN S The presence of RSEN does not impact ARH 


FOUO e Requires organizational affiliation of US 
federal government, or 
e Requires organizational affiliation of US SLTT 
government 
Note: USA country affiliation is not required 


UY La Requires organizational affiliation of US federal 
government department or agency as specified by 
|" | sever 


ee USGOV e Requires organizational affiliation of US 
Executive Branch department or agency, or 
e Requires organizational affiliation of US 
congressional intelligence committee(s) 
Note: Refer to the ORCON-USGOV template in 
Section H.8 for a description of when each item 
above is applicable based on information content 
(i.e., DAP and “Raw” intelligence) 


IMCON |  N_ | The presence of IMCON does not impact ARH 


NOFORN Y e Requires USA country affiliation 
e Requires US federal or SLTT government 
affiliation 


PROPIN Contact the originator for access requirements 
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Marking/Data Attribute Impacts Entity (User) Attribute 
ARH Y/N 


REL TO [USA, LIST] Requires USA or [LIST] country affiliation 


RELIDO N The presence of RELIDO does not impact ARH. 
Note: The presence of RELIDO does not indicate 
an affirmative FD&R decision. Automated access 
determination should result in a NOFORN 
decision if either REL TO or DISPLAY ONLY are 
not also present. 


USA/[LIST] EYES ONLY Requires USA or [LIST] country affiliation 


DEA SENSITIVE Y Requires USA country affiliation, and 
If classified, requires clearance level (final) at 
or above classification marking, and 
Requires one of: 
- Organizational affiliation of US federal 
government, or 
Organizational affiliation of US SLTT 
government with staff role (i.e., 
contractors are not authorized) 
Note: Foreign disclosure and release 
determination requires prior approval by DEA 
(i.e., treat as NOFORN until approval is received, 
if received mark as REL TO.) 


FISA «Requires organizational affiliation of US federal 
government, or 
«Requires organizational affiliation of US SLTT 
government 
Note: USA country affiliation is not required 
DISPLAY ONLY [LIST] Requires [LIST] country affiliation 


Note: The presence of DISPLAY ONLY grants 
viewing only to [LIST] members, but not the ability 
to copy, duplicate, or further disseminate the 
resource in any way. Automated access 
determination should result in a NOFORN 
decision if the restrictions on copy, duplication, or 
further dissemination cannot be ensured. The 
access granted by a REL TO marking is not 
impacted by the presence of DISPLAY ONLY. 
9. Non-Intelligence Community Dissemination Control Markings 

LIMDIS e Requires USA country affiliation, and 

e Requires organizational affiliation of US 
federal government 


Note: Foreign disclosure and release 
determination requires prior approval by the 
originating agency (i.e., treat as NOFORN until 
approval is received, if received mark as REL 
TO.) 
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Marking/Data Attribute Impacts Entity (User) Attribute 
ARH Y/N 


EXDIS Y e Requires USA country affiliation, and 
e Requires organizational affiliation of US 
federal government department or agency as 
specified by originator 


e Requires access by named individual 
e Requires organizational affiliation of US 
federal government 
Note: USA country affiliation is not required 
SBU NOFORN Y Requires USA country affiliation, and 
Requires organizational affiliation of US 
federal government 


LES Y Requires clearance at the level of 
classification of the LES information, and 
Requires one of the following: 

- Organizational affiliation of US federal 
government, or 
- Organizational affiliation of US SLTT 
government, or 
- Need-to-know 
Note: Foreign disclosure and release 
determination requires prior approval by the 
originating agency (if received mark as REL TO.) 


LES NOFORN Y Requires USA country affiliation, and 
Requires clearance at the level of 
classification of the LES NOFORN 
information, and 
Requires one of the following: 
Organizational affiliation of US federal 
government, or 
Organizational affiliation of US SLTT 
government, or 
Need-to-know 
Note: LES NOFORN information may not be share 
any foreign government, foreign national, or interna 
organization regardless of law enforcement affiliatio 
without the express written permission of the origing 
agency. 
SSI Y Requires organizational affiliation of US federal 
government 
Note: USA country affiliation is not required 
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H. (U) IC Markings System Manual 
1. (U) US Classification Markings 


(U) US classification markings are used in the banner line and portion marks of US classified NSI. Originators of 
intelligence information are responsible for determining the appropriate classification marking for the information they 
produce and for applying the appropriate control markings that implement DNI guidelines for dissemination (foreign and 
domestic). Classifiers are to follow internal agency classification management procedures for the use and application of 
classification markings. 


(U) “Collateral” information is defined as classified NSI under the provisions of EO 13526 and not subject to the enhanced 
security protections (e.g., safeguarding, access requirements) required for SCI, SAP, or AEA information. 


(U) The classification marking is the first entry in the banner line. The classification must be spelled out in full and may 
not be abbreviated in the banner line. The four permitted US classification markings are: 


TOP SECRET 

SECRET 

CONFIDENTIAL 

UNCLASSIFIED Note: The marking UNCLASSIFIED refers to the classification status of the information, but it is 
not considered a classification level. 


(U) Note: The US, non-US, and JOINT classification markings are mutually exclusive — a banner line or portion mark may 
only contain one type and value for the classification marking. 


(U) Note: There are only three classification levels defined in EO 13526: CONFIDENTIAL, SECRET, and TOP SECRET. 


UNCLASSIFIED is a marking that indicates the information does not meet the threshold for classification as defined in EO 
13526. 
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(U) Authorized Banner Line Marking Title: TOP SECRET 

(U) Authorized Banner Line Abbreviation: None 

(U) Authorized Portion Mark: TS 

(U) Example Banner Line: TOP SECRET 

(U) Example Portion Mark: (TS) 

(U) Marking Sponsor/Policy Basis: OCA/EO 13526, §1.2(a) 


(U) Definition: Under EO 13526, TOP SECRET must be applied to information, the unauthorized disclosure of which 
reasonably could be expected to cause exceptionally grave damage to the national security that the original 
classification authority (OCA) is able to identify or describe. 


(U) Further Guidance: 
= [SOO Implementing Directive, §2001.24 
= |CD710 
(U) Applicability: Available for use by all agencies. 
(U) Additional Marking Instructions: Applicable only to Top Secret information. 


(U) Relationship(s) to Other Markings: May not be used with US UNCLASSIFIED, CONFIDENTIAL or SECRET; or 
non-US or JOINT classification markings in the banner line or portion mark. 


(U) Precedence Rules for Banner Line Guidance: TOP SECRET takes precedence over SECRET, 
CONFIDENTIAL, and UNCLASSIFIED and must always roll-up to the banner line. 


(U) commingling Rule(s) Within a Portion: 


May be combined with other information at a lower classification level; the TS marking must convey in the 
portion mark. 


= May be used with other markings listed in the Register for the SCI, SAP, AEA, FGI, Dissemination Control, 
and Non-IC Dissemination Control markings categories unless specifically prohibited. 


(U) Notional Example Page: 


TOP SECRET//NOFORN 


(TS//NF) This is the portion mark for a portion that is classified TOP SECRET and is not releasable to foreign 
nationals. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//NOFORN 
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(U) Authorized Banner Line Marking Title: SECRET 

(U) Authorized Banner Line Abbreviation: None 

(U) Authorized Portion Mark: S 

(U) Example Banner Line: SECRET 

(U) Example Portion Mark: (S) 

(U) Marking Sponsor/Policy Basis: OCA/EO 13526, §1.2(a) 


(U) Definition: Under EO 13526, SECRET must be applied to information, the unauthorized disclosure of which 
reasonably could be expected to cause serious damage to the national security that the original classification 
authority is able to identify or describe. 


(U) Further Guidance: 
= [SOO Implementing Directive, §2001.24 
= 1ICD710 


(U) Applicability: Available for use by all agencies. 
(U) Additional Marking Instructions: Applicable only to Secret information. 


(U) Relationship(s) to Other Markings: May not be used with US UNCLASSIFIED, CONFIDENTIAL, or TOP 
SECRET; or non-US or JOINT classification markings in the banner line or portion mark. 


(U) Precedence Rules for Banner Line Guidance: SECRET takes precedence over UNCLASSIFIED and 
CONFIDENTIAL in the banner line. 


(U) Sommingling Rule(s) Within a Portion: 
May be combined with other information at a lower classification level and the S marking must convey in the 
portion mark. 
= SECRET takes precedence over UNCLASSIFIED and CONFIDENTIAL in the portion mark. 
= May be used with other markings listed in the Register for the SCI, SAP, AEA, FGI, Dissemination, and Non- 
IC Dissemination Control Markings categories, unless specifically prohibited. 
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(U) Notional Example Page 1: 


SECRET//RELIDO 


(S//RELIDO) This is the portion mark for a portion that is classified SECRET and the originator has explicitly 
deferred the foreign disclosure and release determination to a SFDRA. This portion is marked for training 
purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//RELIDO 


(U) Notional Example Page 2: 


SECRET//REL TO USA, FVEY 


(S//REL) This is the portion mark for a portion that is classified SECRET and that the originator has determined is 
releasable to FVEY (i.e., USA, AUS, CAN, GBR and NZL). This portion is marked for training purposes only. 


(U) This is the portion mark for an UNCLASSIFIED portion. The foreign releasability of this portion is not 
considered in developing the overall banner line. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the |SOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//REL TO USA, FVEY 


UNCLASSIFIED//rex*— 


49 


251 


UNCLASSIFIED/ /=6ese— 


252 


252 


(U) Authorized Banner Line Marking Title: CONFIDENTIAL 

(U) Authorized Banner Line Abbreviation: None 

(U) Authorized Portion Mark: C 

(U) Example Banner Line: CONFIDENTIAL 

(U) Example Portion Mark: (C) 

(U) Marking Sponsor/Policy Basis: OCA/EO 13526, §1.2(a) 


(U) Definition: Under EO 13526, CONFIDENTIAL must be applied to information, the unauthorized disclosure of 
which reasonably could be expected to cause damage to the national security that the original classification authority 
is able to identify or describe. 


(U) Further Guidance: 
= [SOO Implementing Directive, §2001.24 
= 1ICD710 


(U) Applicability: Available for use by all agencies. 
(U) Additional Marking Instructions: Applicable only to Confidential information. 


(U) Relationship(s) to Other Markings: May not be used with US UNCLASSIFIED, SECRET, or TOP SECRET; or 
non-US or JOINT classification markings, in the banner line or portion mark. 


(U) Precedence Rules for Banner Line Guidance: CONFIDENTIAL takes precedence over UNCLASSIFIED in the 
banner line. 


(U) comming a Rule(s) Within a Portion: 
May be combined with other information at a lower classification level and the C marking must be conveyed 
in the portion mark. 
= CONFIDENTIAL takes precedence over UNCLASSIFIED in the portion mark. 
= May be used with other markings listed in the Register for the SCI, SAP, AEA, FGI, Dissemination Control 
Markings, and Non-IC Dissemination Control Markings categories, unless specifically prohibited. 


(U) Notional Example Page: 


CONFIDENTIAL 


(C) This is the portion mark for a portion that is classified CONFIDENTIAL and for which no foreign disclosure 
determination has been made. Per ICD 710, a foreign disclosure and release determination is encouraged but 
not required for classified information not in a disseminated analytic product. This portion is marked for training 
purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


CONFIDENTIAL 
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(U) Authorized Banner Line 


Marking Title: UNCLASSIFIED 


(U) Authorized Banner Line 


Abbreviation: Mone 

(U) Authorized Portion Mark: U 

(U) Example Banner Line: UNCLASSIFIED 
(U) Example Portion Mark: (U) 


(U) Marking Sponsor/Policy 


Basis: None/EO 13526, §1.6(c) 


(U) Definition: A designation used to mark information that does not meet the criteria for classified (CONFIDENTIAL, 
SECRET or TOP SECRET) national security information as defined by EO 13526. 


(U) Further Guidance: 
= [SOO Implementing Directive, §2001.24 
= 1ICD710 
= ICPG 710.2/403.5 


(U) Applicability: Available for use by all agencies. 


(U) Additional Marking Instructions: 
= Applicable only to unclassified information. 
= A classification authority block does not appear on unclassified information. 


(U) Relationship(s) to Other Markings: 
e May not be used with US, non-US, or JOINT CONFIDENTIAL, SECRET or TOP SECRET classification 
markings in the banner line or portion mark. 
e FD&R markings may be applied but are not required on unclassified information. 


(U) Precedence Rules for Banner Line Guidance: 

= UNCLASSIFIED only rolls-up to the banner line when all portions of the document are UNCLASSIFIED. 

= |fa document has portions of unclassified or unclassified with dissemination controls information that include 
explicit FD&R marking(s), those markings are used in determining the overall document’s banner line FD&R 
marking(s). 

= |fa document has portions of unclassified information without dissemination controls and without explicit 
FD&R marking(s), those portions are not used in determining the overall document’s banner line FD&R 
marking(s). This rule is provided for automated system FD&R banner line aggregation processing. It is 
appropriate for IC classifiers to follow this guidance in the absence of any applicable local agency FD&R 
processes that require additional restrictions or internal controls for FD&R review of unclassified information. 


(U) Commingling Rule(s) Within a Portion: 


= May be combined with other information bearing higher classification levels. May not appear in the portion 
mark when combined with information classified at a higher level. 
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= May be used with other markings listed in the Register for the AEA, FGI, Dissemination, and Non-IC 
Dissemination Control Markings categories, unless specifically prohibited. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): IC classifiers who 
reuse non-IC information in a classified or controlled unclassified IC DAP or other IC information, refer to Section B.3., 
paragraph a., FD&R for IC Disseminated Analytic Products (DAPs) and Table 2 for marking guidance. 
(U) Notes: 
= Unclassified information is withheld from public release until approved for release by the originator. 
= For unclassified documents transmitted over a classified system, the designation "UNCLASSIFIED" must be 
used in the banner line and include any dissemination controls that may apply, such as FOUO or PROPIN. 
= Unclassified information that bears any control markings must also be portion marked. 
= It is optional to have a banner line of “UNCLASSIFIED” on hard copy documents that are UNCLASSIFIED and 
bear no other control markings, such as FOUO or PROPIN. 


e Completely unclassified documents (i.e., no control markings) transmitted over an unclassified system do not 
require a classification marking. 


(U) Notional Example Page 1: 


UNCLASSIFIED 
(U) This is the portion mark for an unclassified portion. This portion is marked for training purposes only. 


(U) Note: A classification authority block does not appear on unclassified information. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


UNCLASSIFIED 
(U) Notional Example Page 2: 


SECRET//REL TO USA, JPN 
(U//FOUO/REL TO USA, JPN) This is the portion mark for an UNCLASSIFIED portion that is FOR OFFICIAL USE 
ONLY and the originator has determined is releasable to USA and JPN. This portion is marked for training 
purposes only. 


(S//REL TO USA, JPN) This is the portion mark for a portion that is classified SECRET and the originator has 
determined is releasable to USA and JPN. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//REL TO USA, JPN 
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(U) Notional Example Page 3: 


SECRET//NOFORN/FISA 
(U//FISA) This is the portion mark for a portion that is UNCLASSIFIED and contains FISA information. This portion 
is considered RELIDO for purposes of developing the overall banner line FD&R marking. This portion is marked for 
training purposes only. 


(S//REL TO USA, GBR) This is the portion mark for a portion that is classified SECRET and that the originator has 
determined is releasable to United Kingdom (GBR). This portion is marked for training purposes only. 


(U) Note: Documents containing multiple portions with different foreign disclosure or release markings must be 
marked overall with the most protective marking. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN/FISA 
(U) Notional Example Page 4: 


UNCLASSIFIED//NOFORN//SBU 


(U//SBU-NF) This is the portion mark for an UNCLASSIFIED portion that is controlled SBU NOFORN. Because this 
portion has an FD&R marking of NOFORN, the overall FD&R marking in the banner line must be NOFORN. This 
portion is marked for training purposes only. 


(U//REL TO USA, FVEY) This is the portion mark for a portion that is UNCLASSIFIED and that the originator has 
determined is releasable to FVEY (i.e., USA, Australia, Canada, New Zealand and United Kingdom). This portion is 
marked for training purposes only. 


(U) Note: Documents containing multiple portions with different foreign disclosure or release markings must be 
marked overall with the most protective marking. 


(U) Note: The classification authority block does not appear on unclassified information. See the ISOO 
Implementing Directive and General Marking Guidance Section of this document for more information. 


UNCLASSIFIED//NOFORN//SBU 


53 
UNCLASSIFIED//rexs— 


255 


256 


UNCLASSIFIED/ /=6ee— 


(U) Notional Example Page 5: 


UNCLASSIFIED//REL TO USA, FVEY 


(U) This is the portion mark for an UNCLASSIFIED portion that is uncaveated (i.e., no dissemination control 
markings). When a document has portions of unclassified information that do not include explicit FD&R 
marking(s), those portions are not used in determining the overall document’s banner line FD&R marking(s). This 
rule is provided for automated system FD&R banner line aggregation processing. It is appropriate for IC classifiers 
to follow this guidance in the absence of any applicable local agency FD&R processes that require additional 
restrictions or internal controls for FD&R review of unclassified information without controls. This portion is marked 
for training purposes only. 


(U//REL TO USA, FVEY) This is the portion mark for a portion that is UNCLASSIFIED and that the originator has 
determined is releasable to FVEY (i.e., USA, Australia, Canada, New Zealand and United Kingdom). The 
releasability of this portion is considered in developing the overall banner line REL TO marking. This portion is 
marked for training purposes only. 


(U) Note: Documents containing multiple portions with different foreign disclosure or release markings must be 
marked overall with the most protective marking. 


(U) Note: The classification authority block does not appear on unclassified information. See the ISOO 
Implementing Directive and General Marking Guidance Section of this document for more information. 


UNCLASSIFIED//REL TO USA, FVEY 
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2. (U) Non-US Protective Markings (Refer to the IC Markings System Manual Appendices A, B, 
and C) 


(U) The Non-US Protective Markings category has been moved and divided into Appendix A, B, and C to clarify for US 
classifiers that there are different protocols for marking US and Non-US information. This document contains the 
protocols for marking US information; protocols for marking Non-US information are found in: 


= Manual Appendix A — Non-US Protective Markings (includes the Five Eyes Marking Comparisons) 
= Manual Appendix B- NATO Protective Markings 
= Manual Appendix C — UN Protective Markings (classified, releasable) 


(U) JOINT Classification Markings 


(U) The JOINT section remains in the US marking system and in this document because the US is the only country using 
the JOINT marking (i.e., US is always a co-owner/producer). The JOINT marking will be added to the Non-US Protective 
Markings Appendix when/if a foreign government(s) adopts the JOINT marking into its classification system. 


(U) FGI Markings 


(U) The FGI section remains in the US marking system and in this document. FGI markings are used by US classifiers to 
identify and protect foreign-owned or foreign-produced information derivatively sourced in a US product. These markings 
are applied based on sharing agreements or arrangements with the source country or international organization. 


3. (U) JOINT Classification Markings 


(U) JOINT classification markings are used on information owned or produced by more than one country and/or 
international organization. The US is the only country using the JOINT marking (i.e., USA is always a co- 
owner/producer). The JOINT marking will appear in the Non-US Protective Markings category if a foreign government(s) 
adopts the JOINT marking into its classification system. The US, non-US, and JOINT classification markings are mutually 
exclusive — a banner line or portion mark may contain only one type and value for the classification marking. 


(U) The JOINT classification marking always starts with a double forward slash (“//") and takes the form: 
JOINT [classification] [LIST]//REL TO [USA, LIST] 


(U) “[LIST]’ pertains to one or more Register, Annex B trigraph country codes or Register, Annex A tetragraph code(s) 
used with the JOINT marking. USA is always included in the JOINT marking [LIST], as USA is always a co- 
owner/producer. 


(U) “[USA, LIST]” pertains to the string that contains “USA” followed by one or more Register, Annex B trigraph country 
code(s), Register, Annex A tetragraph code(s), or Appendix B NATO/NAC markings used with the REL TO marking. 
“USA” must always appear first whenever the REL TO string is used to communicate release decisions either by the US 
or a Non-US entity. Refer to the REL TO marking template in Section H.8 for “[LIST]’ formatting and syntax guidance. 


(U) Note: Jointly classified information requires an explicit foreign release determination at both the portion and banner 
level to at least all of the co-owners using the REL TO [USA, LIST]. The only exception is when the “REL” marking is 
applied (“REL” is an authorized portion mark that may be used when the portion’s [USA, LIST] matches the banner line’s 
[USA, LIST].) 
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(U) Authorized Banner Line Marking Title: 
(U) Authorized Banner Line Abbreviation: 


(U) Authorized Portion Mark (US co-owner) 
(when the portion’s country trigraphs and/or 
tetragraph list is different from the banner line 
JOINT marking): 


(U) Authorized Portion Mark (when the portion’s 
country trigraphs and/or tetragraph list is the same 
as the banner line JOINT): 


(U) Example Banner Line (US co-owner): 


(U) Example Portion Mark (US co-owner): 


(U) Marking Sponsor/Policy Basis: 


I/JOINT [Classification Level] [LIST] 
None 


JOINT [Classification Level Portion Mark] [LIST]//REL TO 
[USA, LIST] 


I/JOINT [Classification Level Portion Mark]//REL TO [USA, LIST] 
(Note: the “REL” portion mark abbreviation may be used with 
the JOINT portion mark, if the portion's “REL TO” country 


trigraphs and/or tetragraph list is the same as the banner line 
REL TO country trigraph and/or tetragraph list.) 


NJOINT TOP SECRET CAN ISR USA//REL TO USA, CAN, ISR 


(/JOINT S AUS USA//REL TO USA, AUS) 


Respective Countries/EO 13526, §6.1(s)(2) 


(U) Definition: This category covers markings for information that is jointly owned and/or produced by more than one 


country/international organization. 


(U) Further Guidance: 


= ISOO Implementing Directive, 32CFR2001, §2001.24(c), Foreign government information 
= [SOO Implementing Directive, 32CFR2001, §2001.54, Foreign government information 
= 1ISOO Implementing Directive, 32CFR2001, §2001.55, Foreign disclosure of classified information 


ICD 710 


(U) Applicability: Available for use by all IC elements. 


(U) Additional Marking Instructions: 


= Applicable to unclassified or classified information. 

= “[LIST]’ pertains to one or more Register, Annex B trigraph country codes or Register, Annex A tetragraph 
code(s) used with the JOINT marking. Country trigraph codes are listed alphabetically followed by tetragraph 
codes in alphabetical order. Multiple codes are separated by a single space. 

= “USA, LIST]’ pertains to the string that contains “USA” followed by one or more Register, Annex B trigraph 
country code(s), Register, Annex A tetragraph code(s), or Appendix B NATO/NAC markings used with the 
REL TO marking. “USA” must always appear first whenever the REL TO string is used to communicate 
release decisions either by the US or a Non-US entity. Refer to the REL TO marking template in Section H.8 


for “[LIST]’ formatting and syntax guidance. 


(U) Relationship(s) to Other Markings: 


= May be used with TOP SECRET, SECRET, CONFIDENTIAL, or UNCLASSIFIED classification markings. 
= May not be used with RESTRICTED. (Note: the US is always a JOINT marking owner/producer; and 
RESTRICTED is not an authorized US classification marking.) 
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Requires REL TO USA, LIST 

May be used with SCI (excluding HCS markings), SAP, AEA, FGI, IC and Non-IC dissemination control 
markings (excluding NOFORN), as appropriate. Note: Agencies that create JOINT products are required to 
provide specific marking guidance regarding when it’s appropriate to use other marking categories with a 
JOINT classification marking. 

May not be used with the HCS markings or NOFORN markings. 


(U) Notes: 


The JOINT marking in the banner line and in the portion mark indicates co-ownership and releasability of the 
entire document or portion only to the co-owners. All JOINT information is withheld from further release until 
approved for release by the co-owners. 

JOINT classified information for which the US is a co-owner, must be appropriately classified and explicitly 
marked with a REL TO marking that includes the US and all co-owners, at both the banner and portion level. 
While the application of US control markings with the JOINT marking may not be a frequent operational need, 
the markings are allowed “as appropriate” to ensure technical standards and systems do not prohibit the 
combination and possibly impede information sharing. 

JOINT classified documents require a classification authority block because the US is always a co-owner. 
See the ISOO Implementing Directive and General Marking Guidance Section of this document for more 
information. 

If FGI information is used in a JOINT classified document, refer to Section H.7 of this document for more 
information on FGI marking format and syntax. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): JOINT information 
may be sourced in a US document provided that (see example 3): 


All co-owners have pre-approved its use. 

The portion mark must adhere to the following guidelines: 

e JOINT marked portions must be segregated from US classified portions if the document is not marked in 
accordance with ICD 206, Sourcing Requirements for Disseminated Analytic Products, dated 17 October 
2007. If the document is marked in accordance with ICD 206, the JOINT information may be commingled 
with US information in the same portion and the JOINT information must be identified in the source 
reference citations as endnotes in the disseminated analytic product. 

e If the JOINT portion is extracted into a US document then the co-owner country trigraph code(s) and/or 
tetragraph code(s) must be listed i.e., (//JOINT S [trigraphs and/or tetragraphs)). 

e When extracting a JOINT portion marked with the authorized REL TO marking abbreviation “REL” from a 
source document, carry forward the trigraph/tetragraph codes listed in the source document banner line to 
the new portion mark (see page example below). 

The banner line contains the following: 

e Highest classification level of all portions, expressed as a US classification marking. Note: The JOINT 
marking is not carried forward to the banner line in US documents, but remains for applicable portions. 

e The FGI marking including all trigraph/tetragraph codes identified in the JOINT portion(s). 

e RELTO, including all common non-US country trigraph/tetragraph codes identified in the JOINT portions, 
unless a portion is marked NOFORN, in which case the NOFORN marking must appear in the banner line. 


(U) Warnings and Notices: JOINT documents may have distribution or warning statements to provide additional 
guidance regarding document ownership and handling instructions, such as citing the declassification authority. Any 
such statements may not restrict dissemination beyond the restrictions already imposed by the authorized control 
markings and must be consistent with any and all dissemination controls. 
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(U) Notional Example Page 1: 


HJOINT SECRET CAN GBR USA//REL TO USA, CAN, GBR 


(//JOINT S//REL) This is the portion mark for a portion that is classified JOINT Canadian (CAN), United Kingdom 
(GBR), and US SECRET. The JOINT portion mark indicates co-ownership and releasability of the entire portion 
only to the co-owners (same as banner line). This portion is marked for training purposes only. 


(/JOINT S CAN GBR USA//REL TO USA, FVEY) This is the portion mark for a portion that is classified JOINT 
Canadian (CAN), United Kingdom (GBR), and US SECRET as the co-owners have authorized further release to 
Australia (AUS) and New Zealand (NZL) as part of FVEY. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all JOINT classified documents because the US is a co- 
owner. See the ISOO Implementing Directive and General Marking Guidance Section of this document for more 
information. 


HJOINT SECRET CAN GBR USA//REL TO USA, CAN, GBR 


(U) Notional Example Page 2: 


/IJOINT SECRET GBR USA//REL TO USA, FVEY 


(//JOINT S//REL) This is the portion mark for a portion that is classified JOINT United Kingdom and US SECRET. 
The United Kingdom and US as co-owners have authorized further release to Australia, Canada, and New 
Zealand (same as banner line). This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all JOINT classified documents because the US is a co- 
owner. See the ISOO Implementing Directive and General Marking Guidance Section of this document for more 
information. 


/IJOINT SECRET GBR USA//REL TO USA, FVEY 
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(U) Notional Example Page 3: 


JOINT SECRET GBR USA//FGI NZL//REL TO USA, GBR 


(//JOINT S//REL) This is the portion mark for a portion that is classified JOINT United Kingdom (GBR) and US 
SECRET. The JOINT portion mark indicates co-ownership and releasability of the entire portion only to the co- 
owners (same as banner line). This portion is marked for training purposes only. 


(//JOINT S GBR USA//REL TO USA, FVEY) This is the portion mark for a portion that is classified JOINT United 
Kingdom (GBR) and US SECRET, as the co-owners have authorized further release to Australia (AUS), Canada 
(CAN) and New Zealand (NZL) as part of FVEY. This portion is marked for training purposes only. 


(//JOINT S GBR USA//FGI NZL//REL TO USA, FVEY) This is the portion mark for a portion that is classified JOINT 
United Kingdom (GBR) and US SECRET and contains New Zealand (NZL) SECRET data that New Zealand has 
authorized release back to NZL and further release to USA, Australia (AUS), Canada (CAN) and United Kingdom 
(GBR) as part of FVEY. The JOINT portion mark indicates co-ownership and releasability of the entire portion only 
to the co-owner. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all JOINT classified documents because the US is a co- 
owner. See the ISOO Implementing Directive and General Marking Guidance Section of this document for more 
information. 


HJOINT SECRET GBR USA//FGI NZL//REL TO USA, GBR 


(U) Notional Example Page 4: 


SECRET//FGI ISAF NATO//REL TO USA, GBR 


(/JOINT S GBR USA//REL) This is the portion mark for a portion that is classified JOINT United Kingdom (GBR) 
and US SECRET. The JOINT portion mark indicates co-ownership and releasability of the entire portion only to 
the co-owners (same as banner line). This portion is marked for training purposes only. 


(//JOINT S GBR USA//REL TO USA, FVEY) This is the portion mark for a portion that is classified JOINT United 
Kingdom (GBR) and US SECRET as the co-owners have authorized further release to Australia (AUS), Canada 
(CAN) and New Zealand (NZL) as part of FVEY. This portion is marked for training purposes only. 


(//NIS//REL TO USA, ISAF, NATO) This is the portion mark for a portion that contains NATO ISAF SECRET 
(authorized portion mark is “NIS”) data that NATO has authorized release back to ISAF and NATO. This portion 
must contain only NATO ISAF SECRET FGI releasable to the countries in the REL TO list (Note: The originating 
agency has authorized ISAF to be expanded for roll-up purposes.) Use Register, Annex B trigraph country codes 
or Register, Annex A tetragraph code(s). This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


(U) Note: The banner line is a US classification marking, because JOINT always includes US information (only 
the US applies this marking) and when US and non-US portions are combined in a single document, the overall 
marking is a US classification. 


SECRET//FGI ISAF NATO//REL TO USA, GBR 
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4. (U) Sensitive Compartmented Information Control System Markings 


(U) General Information 


(U) Sensitive Compartmented Information (SCI) is classified national intelligence information concerning or derived from 
intelligence sources, methods or analytic processes that is required to be handled within formal access control systems 
established by the DNI. The SCI control system structure is the system of procedural protective mechanisms used to 
regulate or guide each program established by the DNI as SCI. A control system provides the ability to exercise restraint, 
direction, or influence over or provide that degree of access control or physical protection necessary to regulate, handle or 
manage information or items within an approved program. Compartments and sub-compartments may exist within an SCI 
control system to further protect and/or distinguish SCI. Multiple values within each hierarchical level are listed in 
ascending sort order with numbered values first followed by alphabetic values. Figure 4 below illustrates the basic 
hierarchical structure of an SCI control system (i.e., SI with published and unpublished markings.) 


(U) This figure is UNCLASSIFIED. 


SCI Control System 
(e.g., SI) 


Compartment 
(e.g., EEE) 


Compartment 
(e.g., G) 


Sub-compartment 
(e.g., JJJ) 


Sub-compartment 
(e.g., ABCD) 


Sub-compartment 
(e.g., WXYZ) 


Sample banner line SCI category as depicted: //SI-EEE JJJ-G ABCD WXYZ// 


Figure 4: (U) SCI Control System Hierarchical Structure 


(U) For the purpose of succinctness in the banner and portion mark, the IC SCI Marking Standard is not intended to show 


direct hierarchy/structure beyond or beneath the sub-compartment level. To display a program beyond the sub- 
compartment level, move the subordinate program up to the sub-compartment level and list the sub-compartment(s) in 
ascending sort order with numbered values first followed by alphabetic values. In this manner, the relationship to the 
compartment will be shown, but because the sub-compartments are listed in ascending sort order, direct hierarchy of the 
sub-compartment(s) will not be shown. Refer to the syntax rules below and Table 6 for additional guidance and a marking 
sample. 


(U) Four SCI control systems are published in the Register. 


= HCS 
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RESERVE (RSV) 
Special Intelligence (SI) 
TALENT KEYHOLE (TK) 


(U) In addition to the published SCI control systems, the ODNI/P&S maintains a list of registered but unpublished SCI 
control systems. These must remain unpublished due to sensitivity and restrictive access controls. Individuals 
encountering information with unpublished markings in the SCI or SAP marking category should contact ODNI/P&S/IMD 


(b)(3) 50 U.S.C. 30241 for guidance. 


(U) Use the following syntax rules for both portion marks and banner lines for all published and unpublished SCI control 
systems: 


Use a double forward slash (“//”) with no interjected space to separate the US classification marking and the SCI 
control system marking. 

Multiple control systems may be used in the SCI control system category, if applicable. 

Multiple SCI control system markings must be listed in ascending sort order with numbered values first followed 
by alphabetic values separated by a single forward slash with no interjected space (“/”). 

An SCI control system may have multiple compartments. 

Multiple compartments within an SCI control system must be listed in ascending sort order with numbered values 
first followed by alphabetic values separated by a hyphen (“-“), i.e., a hyphen will precede each compartment. 
An SCI compartment may have multiple sub-compartments. 

Multiple sub-compartments must be listed in ascending sort order with numbered values first followed by 
alphabetic values separated by a space, i.e., a space will precede each sub-compartment. 

Only unique SCI control system, compartment, or sub-compartment markings will be used, i.e., no marking must 
be repeated within the SCI Control Marking category. 

SCI type indicator markings used to group compartments, such as “ECI”, must not be used. 


(U) The sample banner below illustrates the syntax rules for the SCI Control Marking category. The separators have been 
enlarged and bolded for illustrative purposes. Refer to Table 6 below for a listing of each marking category and marking 
used in the sample: 


TOP SECRET//FGH-AAA 123-LLL SSS/MMM-XYZ/SI-G QURT-PPP/TK//ORCON/NOFORN 


Table 6: (U) SCI Sample Banner Marking Categories and Markings 


(U) This table is UNCLASSIFIED. 


SCI Compartments AAA is a compartment (unpublished) of FGH 
LLL is a compartment (unpublished) of FGH 
XYZ is a compartment (unpublished) of MMM 


G is a compartment (published) of SI 

PPP is a compartment (unpublished) of SI 
SCI Sub-Compartments 123 is a sub-compartment of AAA under FGH 
(Note: all sub-compartments in the example are SSS is a sub-compartment of LLL under FGH 
fictitious unpublished values) QURT is a sub-compartment of G under SI 


Dissemination Control Markings ORCON, NOFORN 
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(U) For Legacy Information Banner Line 


Marking Title HCS (requires associated compartment, see below for legacy 


guidance) 


(U) For Legacy Information Banner Line 


Abbreviation HCS (requires associated compartment, see below for legacy 


guidance) 


(U For Legacy Information Portion Mark: HCS (requires associated compartment, see below for legacy 
guidance) 


(U) Example Banner Line: 
TOP SECRET//HCS//NOFORN (for legacy information only) 


(U) Example Portion Mark: (TS//HCS//NF) (for legacy information only) 


(U) Marking Sponsor/Policy Basis: DNI/EO 13526, §4.3 


(U) Definition: HCS is an SCI control system that comprises two compartments, Operations and Product, and is 
intended to provide enhanced protection to exceptionally fragile clandestine HUMINT sources, methods, and activities 
based on assessed value, critical nature, and vulnerability of the information. IC clandestine HUMINT collector 
organizations may elect to use HCS to protect their most sensitive HUMINT information upon the approval of the 
CIA/Deputy Director for Operations in accordance with national HUMINT policy. 


(U) Further Guidance: 
= EO 13526, §4.3 
ICD 703 
ICD 304 
ICD 710 
HCS Security Manual 
HCS Classification Guide 
PDDNI Memo ES 2014-00847, Postponement of Changes to the HUMINT Control System 


(U) Applicability: Central Intelligence Agency (CIA). 


(U) Additional Marking Instructions: 
= Applicable only to classified information. 
= When legacy information at the CONFIDENTIAL//HCS level is discovered, contact the originator for guidance 
prior to reusing the information. 


(U) Relationship(s) to Other Markings: 
= When incorporating legacy material marked “HCS” into a new product, re-mark the new document and associated 
portion according to the instructions in the HCS-O and HCS-P marking templates. However, legacy information 
previously marked HCS and transmitted via machine-to-machine processes may retain the HCS marking without 
requiring translation to either HCS-O or HCS-P. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must always 
appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate. The HCS 
marking or HCS-O and/or HCS-P marking(s) must be conveyed in the portion mark. Legacy HCS-marked information may 
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be combined with newly created information but the portion mark must include either HCS-P, HCS-O, or HCS-O-P, if 
applicable. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): HCS information may be 


reused in accordance with relevant IC policy and/or procedures. Disseminated legacy material carrying the HCS marking 
must be re-marked according to the instructions for HCS-O and/or HCS-P when reused in a new document. 
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(U) Authorized Banner Line Marking Title: O 

(U) Authorized Banner Line Abbreviation: O 

(U) Authorized Portion Mark: O 

(U) Example Banner Line: SECRET//HCS-O//ORCON/NOFORN 
(U) Example Portion Mark: (S//HCS-O//OC/NF) 

(U) Marking Sponsor/Policy Basis DNI/EO 13526, §4.3 


(U) Definition: A compartment under the HUMINT Control System. The Operations compartment is used to protect 
exceptionally fragile and unique IC clandestine HUMINT operations and methods. Each clandestine HUMINT collector 
organization that elects to use the HUMINT Control System to protect its most sensitive HUMINT is authorized to 
activate an operations compartment upon the approval of the ClA/Deputy Director of Operations in accordance with 
national HUMINT policy. 


(U) Further Guidance: 
= EO 13526, §4.3 
ICD 304 
ICD 703 
ICD 710 
HCS Program Manual 
HCS Classification Guide 
PDDNI Memo ES 2014-00847, Postponement of Changes to the HUMINT Control System 


(U) Applicability: Central Intelligence Agency (CIA). 


(U) Additional Marking Instructions: 
= Applicable only to Top Secret and Secret information. 
= The HCS-O marking is unclassified when standing alone. 
= If reused, legacy operational data marked “HCS” may be re-marked HCS-O if the data conforms to the 
requirements for the HCS-O marking. Please consult your HCS Control Officer for details. 


(U) Relationship(s) to Other Markings: 
= May only be used with TOP SECRET or SECRET. 
= Requires ORCON and NOFORN. 
= May not be used with ORCON-USGOV. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must 
always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate (to include 
HCS-P) and the HCS-O marking must be conveyed in the portion mark. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): HCS-O 
compartmented information may be made available to HCS-O briefed individuals in other US government departments 
and agencies only when based on the terms of a mutual agreement between the CIA and the head, or designee, of the 
receiving organization or element. Derivative reuse within the CIA must be in accordance with CIA policy and/or 
procedures. See above precedence and commingling rules. 


UNCLASSIFIED//rese— 
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(U) Notional Example Page: 


SECRET//HCS-O//ORCON/NOFORN 


(S//HCS-O//OC/NF) This is the portion mark for a portion that is classified SECRET, contains HCS-O information 
that is originator controlled, and not releasable to foreign nationals. This portion is marked for training purposes 
only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//HCS-O//ORCON/NOFORN 
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(U) Authorized Banner Line Marking Title: P 

(U) Authorized Banner Line Abbreviation: P 

(U) Authorized Portion Mark: P 

(U) Example Banner Line: SECRET//HCS-P//NOFORN 
(U) Example Portion Mark: (S//HCS-P//NF) 

(U) Marking Sponsor/Policy Basis DNI/EO 13526, §4.3 


(U) Definition: A compartment under the HUMINT Control System. The Product compartment is used to protect 
intelligence information (products) intended for dissemination to IC consumers when: 
= There is a clear and demonstrable expectation that the intelligence reveals a risk to the life, liberty, or welfare of 
the human source; 
= Unauthorized disclosure would create a clear and demonstrable expectation of loss or compromise of a critical 
or unique intelligence window, scientific technique, or technical collection capability; 
= Unauthorized disclosure would cause loss or compromise of other U.S. national collection capabilities or 
national security interests; 
= Unauthorized disclosure would cause of data acquired through fragile or unique human-enabled technical 
capabilities. 


(U) ret Guidance: 

ICD 304 

ICD 703 

ICD 710 

HCS Program Manual 

HCS Classification Guide 

PDDNI Memo ES 2014-00847, Postponement of Changes to the HUMINT Control System 


(U) Applicability: Central Intelligence Agency (CIA). 
(U) Additional Marking Instructions: Applicable only to classified information. 


(U) peruone Pe to Other Markings: 

May be used with TOP SECRET or SECRET. 

= DAPs bearing legacy markings must be re-marked HCS-P if reused, provided there is no HCS operational 
information in the product. If the analytic product contains both operational information and disseminated 
nonoperational information, the product must be re-marked to reflect both HCS-O-P (to include any sub- 
compartments if applicable). 

= Requires NOFORN 

= ORCON or ORCON-USGOV may be used. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must 
always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate (to include 
HCS-O) and the HCS-P marking must be conveyed in the portion mark. 
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(U) Derivative Use (i.e., reuse of information in whole or in part in intelligence products): 
HCS-P information may be reused in accordance with relevant policy and/or procedures. See above precedence 
and commingling rules. 


(U) Notional Example Page: 


SECRET//HCS-P//NOFORN 


(S//HCS-P//NF) This is the portion mark for a portion that is classified SECRET, contains HCS-P information 
that is not releasable to foreign nationals. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//HCS-P//NOFORN 
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P [SUB-COMPARTMENT] (up to 6 alphanumeric characters 
for the graph that represents the name of the sub- 
compartment) 


(U) Authorized Banner Line Marking Title: 


P [SUB-COMPARTMENT] (up to 6 alphanumeric characters 
(U) Authorized Banner Line Abbreviation: for the graph that represents the name of the sub- 
compartment) 


P [SUB-COMPARTMENT] (up to 6 alphanumeric characters 


(U) Authorized Portion Mark: for the graph that represents the name of the sub- 
compartment) 

(U) Example Banner Line: TOP SECRET//HCS-P JJJ//ORCON/NOFORN 

(U) Example Portion Mark: (TS/HCS-P JJJ//OC/NF) 


(U) Example Banner Line with Multiple PRODUCT TOP SECRET//HCS-P JJJ XYZ//ORCON/NOFORN 
Identifiers: 


(U) Example Portion Mark with Multiple PRODUCT = (TS//HCS-P JJJ XYZ//OC/NF) 
Identifiers: 


(U) Marking Sponsor/Policy Basis: DNI/EO 13526, §4.3 


(U) Definition: An HCS-P sub-compartment. Intelligence products containing information that requires extremely 
restricted access may be further protected in the HCS-P compartments. 


(U) Further Guidance: 


= ICD 304 

= ICD 703 

= ICD 710 

= HCS Program Manual 

= HCS Classification Guide 


PDDNI Memo ES 2014-00847, Postponement of Changes to the HUMINT Control System 
(U) Applicability: Central Intelligence Agency (CIA). 


(U) Additional Marking Instructions: 
=  HCS-P sub-compartment markings are UNCLASSIFIED//FOUO when standing alone. 


(U) Relationship(s) to Other Markings: 
= May only be used with TOP SECRET. 
= Requires HCS-P, ORCON, and NOFORN. 
= May not be used with ORCON-USGOV. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must 
always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate (to include 
HCS-O). HCS-P sub-compartment(s) marking must be conveyed in the portion mark. 
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(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): HCS-P sub- 
compartment information may be reused in accordance with relevant policy and/or procedures. See above precedence 
and commingling rules. 


(U) Notional Example Page: 


TOP SECRET//HCS-P EFG//ORCON/NOFORN 


(TS//HCS-P EFG//OC/NF) This is the portion mark for a portion that is classified TOP SECRET, contains HCS- 
PRODUCT EFG information, is originator controlled, and not releasable to foreign nationals. This portion is 
marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//HCS-P EFG//ORCON/NOFORN 
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(U) Authorized Banner Line Marking Title 


(requires associated compartment): eee 
(U) Authorized Banner Line Abbreviation 
à i f RSV 
(requires associated compartment): 
(U) Authorized Portion Mark (requires associated 
. RSV 
compartment): 
(U) Example Banner Line: SECRET//RSV-ABC 
(U) Example Portion Mark: (S//RSV-ABC) 
(U) Marking Sponsor/Policy Basis: DNI/DCI Memorandum for the NRO Director of Security, 10 
January 2005 


(U) Definition: RESERVE is an SCI control system designed to protect National Reconnaissance Office (NRO) 
information pertaining to new sources and methods during the research and development acquisition phases. 


(U) Further Guidance: 
= DCI Memo, 10 January 2005 
ICD 703 
ICD 710 
NRO Directive 100-35, NRO RESERVE Control System, 26 April 2013 
NRO Instruction 100-35-1, Establishment, Management, and Disposition of NRO RESERVE Compartments, 
2 September 2014 


(U) Applicability: Agency specific. NRO authorization required. 


(U) Additional Marking Instructions: 
= Applicable only to Top Secret and Secret information. 
= All RESERVE information is contained within individual compartments; the RSV marking may not be used 
alone and requires the associated compartment. 


(U) Relationship(s) to Other Markings: 
= May only be used with TOP SECRET or SECRET. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must 
always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate. The relevant 
RSV marking must be conveyed in the portion mark. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): RSV information may 
not be sourced. 
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(U) Notional Example Page: 


TOP SECRET//RSV-ABC//NOFORN 


(TS//RSV-ABC//NF) This is the portion mark for a portion that is classified TOP SECRET, contains RESERVE 


information from the ABC compartment, and is not releasable to foreign nationals. This portion is marked for 
training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//RSV-ABC//NOFORN 
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(U) Authorized Banner Line Marking Title: RESERVE-[COMPARTMENT] (3 alphanumeric characters) 
(U) Authorized Banner Line Abbreviation: RSV-[COMPARTMENT] (3 alphanumeric characters) 

(U) Authorized Portion Mark: RSV-[COMPARTMENT] (3 alphanumeric characters) 

(U) Example Banner Line: TOP SECRET//RSV-123 

(U) Example Portion Mark: (TS//RSV-123) 


(U) Example Banner Line with Multiple 


Compartments: TOP SECRET//RSV-123-ABC 


(U) Marking Sponsor/Policy Basis: DNI/DCI Memorandum for the NRO Director of Security, 10 
January 2005 


(U) Definition: An RSV compartment. The RSV compartment consists of 3 alphanumeric characters. 


(U) Further Guidance: 
= DCI Memo, 10 January 2005 
ICD 703 
ICD 710 
NRO Directive 100-35, NRO RESERVE Control System, 26 April 2013 
NRO Instruction 100-35-1, Establishment, Management, and Disposition of NRO RESERVE Compartments, 
2 September 2014 


(U) Applicability: Agency specific. NRO authorization required. 


(U) Additional Marking Instructions: Applicable only to Top Secret and Secret information. 


(U) Relationship(s) to Other Markings: 
= May only be used with TOP SECRET or SECRET. 
= Requires RESERVE. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must 
always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate. The relevant 
RSV compartment marking must be conveyed in the portion mark. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): RSV compartment 
information may not be sourced. 
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(U) Notional Example Page: 


TOP SECRET//RSV-123-ABC//NOFORN 


(TS//RSV-ABC//NF) This is the portion mark for a portion that is classified TOP SECRET, contains RSV-ABC 
information, and is not releasable to foreign nationals. This portion is marked for training purposes only. 


(TS//RSV-123//NF) This is the portion mark for a portion that is classified TOP SECRET, contains RSV-123 
information, and is not releasable to foreign nationals. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the |SOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//RSV-123-ABC//NOFORN 


73 
UNCLASSIFIED//rexs— 


2715 


276 


UNCLASSIFIED/ /=6ese— 


(U) Authorized Banner Line Marking Title: Sl 

(U) Authorized Banner Line Abbreviation: SI 

(U) Authorized Portion Mark: SI 

(U) Example Banner Line: TOP SECRET//SI 
(U) Example Portion Mark: (TS//SI) 


(U) Marking Sponsor/Policy Basis: DNI/National Security Act of 1947 (as amended) Title |, §105 


(b)(1) 


(U) Definition: Special Intelligence, or SI, is an SCI control system designed to protect technical and intelligence 
information derived from monitoring foreign communications signals by other than the intended recipients. The Sl 
control system protects Sl-derived information and information relating to SI activities, capabilities, techniques, process 
and procedures. 
(U) Further Guidance: 

= ICD 703 


= ICD 710 
= NSA/CSS COMINT Classification Guide 


(U) Applicability: Agency specific. 
(U) Additional Marking Instructions: Applicable only to classified information. 


(U) Relationship(s) to Other Markings: May only be used with TOP SECRET, SECRET, or CONFIDENTIAL. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must 
always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate. The relevant 
SI marking must be conveyed in the portion mark. 


(U) Note: The COMINT title for the Special Intelligence (SI) control system is no longer valid. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): SI information may be 
sourced in accordance with relevant policy and/or procedures. See above precedence and commingling rules. 
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SECRET//SI//REL TO USA, FVEY 
(S//SI//REL TO USA, FVEY) This is the portion mark for a portion that is classified SECRET and contains SI 
information that is releasable to FVEY (i.e., USA, Australia, Canada, New Zealand and United Kingdom) within a 
US classified document. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//SI//REL TO USA, FVEY 
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UNCLASSIFIED/ /=6ese— 


(U) Authorized Banner Line Marking Title: SI-[COMPARTMENT] (2-3 alpha characters) 

(U) Authorized Banner Line Abbreviation: SI-[COMPARTMENT] (2-3 alpha characters) 

(U) Authorized Portion Mark: SI-[COMPARTMENT] (2-3 alpha characters) 

(U) Example Banner Line: TOP SECRET//SI-ABC//[Explicit FD&R] 

(U) Example Portion Mark: (TS/SI-ABC) 

(U) Example Banner Line with Multiple TOP SECRET//SI-ABC-EFG-G PXYZ//ORCON/[Explicit 
Compartments: FD&R] 

(U) Marking Sponsor/Policy Basis: DNI/National Security Act of 1947, as amended, Title |, 


§105 (b)(1) 


(U) Definition: SI non-GAMMA compartment. Non-GAMMA SI compartments consist of 2-3 alphabetic characters. 


(U) Further Guidance: 


= DCID 6/1 
= ICD 703 
= ICD710 
= NSA/CSS COMINT Classification Guide 


(U) Applicability: Agency specific. 


(U) Additional Marking Instructions: 
= Applicable only to Top Secret information. 


= SCI type indicators used to group compartments, such as “ECI”,_ must not be used in the banner line and 
portion mark. For example, information formerly marked TS//SI-ECI ABC must now be marked TS//SI-ABC. 


(U) Relationship(s) to Other Markings: 
= May only be used with TOP SECRET. 
= Requires Sl. 


(U) Precedence Rules for Banner Line Guidance: Multiple compartments within the SI control system must be 
listed alphabetically separated by a hyphen. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate. The SI 
compartment marking must be conveyed in the portion mark. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): SI compartment 
information may be sourced in accordance with relevant policy and/or procedures. See above precedence and 
commingling rules. 


76 
UNCLASSIFIED//F%e— 
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UNCLASSIFIED/ /=6ee— 


(U) Notional Example Page: 


TOP SECRET//SI-ABC//NOFORN 


(TS//SI-ABC//NF) This is the portion mark for a portion that is classified TOP SECRET, contains SI-ABC 
information, and is not releasable to foreign nationals. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the |SOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//SI-ABC//NOFORN 
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UNCLASSIFIED/ /=6ese— 


(U) Note: Per ODNI direction, the EL control system is being retired and all associated compartments moved to the SI 
control system. NIA in coordination with NSA are working on this transition. Guidance below reflects new marking 
guidance for ECRU within the SI control system. 


(U) Authorized Banner Line Marking Title: SI-ECRU 

(U) Authorized Banner Line Abbreviation: SI-EU 

(U) Authorized Portion Mark: SI-EU 

(U) Example Banner Line: TOP SECRET//SI-EU 

(U) Example Portion Mark: (TS//SI-EU) 

(U) Marking Sponsor/Policy Basis: DNI/National Security Act of 1947, as amended, Title |, §105 


(b)(1) 
(U) Definition: An ECI used to protect technical data derived from exploitation of a high interest signal. 


(U) Further Guidance: 


= ICD 703 

= ICD 710 

= NSA/CSS Policy 1-41 

= Signals Intelligence Security Regulations (SISR) 
= ECRU Classification Guide 


(U) Applicability: Agency specific. 


(U) Additional Marking Instructions: 
= Applicable only to Top Secret information. 
= Refer to the ECRU Classification Guide for classification guidance. 


(U) Relationship(s) to Other Markings: 
= May only be used with TOP SECRET. 
= Requires SI and ECRU. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must 
always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate and the SIl- 
EU marking must be conveyed in the portion mark. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): ECRU information 
may be sourced in accordance with relevant IC policy and/or procedures. See above precedence and commingling 
rules. 


(U) Warnings and Notices: N/A 
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UNCLASSIFIED//rex*— 
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UNCLASSIFIED/ /=6ee— 


(U) Notional Example Page: 


TOP SECRET// SI-EU//REL TO USA, CAN, GBR 


(TS// SI-EU//REL) This is the portion mark for a portion that is classified TOP SECRET, contains ECRU and 


SI information, and is authorized for release to Canada (CAN) and United Kingdom (GBR). This portion is 
marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET// SI-EU//REL TO USA, CAN, GBR 
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(U) Authorized Banner Line Marking Title: GAMMA 

(U) Authorized Banner Line Abbreviation: G 

(U) Authorized Portion Mark: G 

(U) Example Banner Line: TOP SECRET//SI-G//ORCON 

(U) Example Portion Mark: (TS/SI-G//OC) 

(U) Marking Sponsor/Policy Basis: DNI/National Security Act of 1947, as amended, Title 1, §105 


(b)(1) 
(U) Definition: An SI compartment. 


(U) Further Guidance: 
= ICD 703 
= ICD 710 
= NSA/CSS COMINT Classification Guide 


(U) Applicability: Agency specific. 
(U) Additional Marking Instructions: Applicable only to Top Secret information. 


(U) Relationship(s) to Other Markings: 
= May only be used with TOP SECRET. 
= Requires SI and ORCON. 
= May not be used with ORCON-USGOV. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must 
always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information (excluding ORCON-USGOV) 
when appropriate and the SI-G marking must be conveyed in the portion mark. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): SI-GAMMA information 
may be sourced in accordance with relevant policy and/or procedures. See above precedence and commingling rules. 


(U) Notional Example Page: 


TOP SECRET//SI-G//ORCON/NOFORN 


(TS//SI-G//OC/NF) This is the portion mark for a portion that is classified TOP SECRET, contains SI-GAMMA 
information, is originator controlled, and not releasable to foreign nationals. This portion is marked for training 
purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//SI-G//ORCON/NOFORN 
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(U) Authorized Banner Line Marking Title: GAMMA [SUB-COMPARTMENT] (4 alpha characters) 

(U) Authorized Banner Line Abbreviation: G [SUB-COMPARTMENT] (4 alpha characters) 

(U) Authorized Portion Mark: G [SUB-COMPARTMENT] (4 alpha characters) 

(U) Example Banner Line: TOP SECRET//SI-G ABCD//ORCON/Explicit FD&R] 

(U) Example Portion Mark: (TS/SI-G ABCD//OC/[Explicit FD&R]) 

(U) Example Banner Line with Multiple GAMMA TOP SECRET//SI-G ABCD EFGH//ORCON/[Explicit FD&R] 
Identifiers: 

(U) Marking Sponsor/Policy Basis: DNI/National Security Act of 1947, as amended, Title 1, §105 


(b)(1) 
(U) Definition: An SI-GAMMA sub-compartment. 


(U) Further Guidance: 
= ICD 703 
= ICD 710 
= NSA/CSS COMINT Classification Guide 


(U) Applicability: Agency specific. 
(U) Additional Marking Instructions: Applicable only to Top Secret information. 
(U) Relationship(s) to Other Markings: 

= May only be used with TOP SECRET. 

= Requires SI, G, and ORCON. 

= May not be used with ORCON-USGOV. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must 
always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information (excluding ORCON-USGOV), 
when appropriate. The SI-G sub-compartment marking(s) must be conveyed in the portion mark. 


(U) Notes: Multiple GAMMA identifiers must be listed in alphabetical order, with a space to separate each identifier. 
For example: SI-GAMMA ABCD EFGH WXYZ. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): SI-GAMMA sub- 
compartment information may be sourced in accordance with relevant policy and/or procedures. See above 
precedence and commingling rules. 
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284 


UNCLASSIFIED/ /=6ee— 


(U) Notional Example Page: 


TOP SECRET//SI-G ABCD//ORCON/NOFORN 


(TS//SI-G ABCD//OC/NF) This is the portion mark for a portion that is classified TOP SECRET, contains SI-GAMMA 


ABCD information, is originator controlled, and not releasable to foreign nationals. This portion is marked for training 
purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//SI-G ABCD//ORCON/NOFORN 
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(U) Note: Per ODNI direction, the EL control system is being retired and all associated compartments moved to the SI 
control system. NIA in coordination with NSA are working on this transition. Guidance below reflects new marking 
guidance for NONBOOK within the SI control System. 


(U) Authorized Banner Line Marking Title: SI-NONBOOK 

(U) Authorized Banner Line Abbreviation: SI-NK 

(U) Authorized Portion Mark: SI-NK 

(U) Example Banner Line: TOP SECRET// SI-NK 

(U) Example Portion Mark: (TS// SI-NK) 

(U) Marking Sponsor/Policy Basis: DNI/National Security Act of 1947, as amended, Title |, §105 


(b)(1) 


(U) Definition: An SI compartment used for sensitive intelligence products intended for dissemination to IC 
consumers. 


(U) Further Guidance: 


= ICD 703 

= ICD 710 

= NSA/CSS Policy 1-41 

= Signals Intelligence Security Regulations (SISR) 
= NONBOOK Classification Guide 


(U) Applicability: Agency specific. 


(U) Additional Marking Instructions: 
= Applicable only to Top Secret information. 
= Refer to the NONBOOK Classification Guide for classification guidance. 


(U) Applicable Level(s) of Classification: 

= May be used only with TOP SECRET. 

= For classification guidance, refer to the NONBOOK Classification Guide. 
(U) Relationship(s) to Other Markings: Requires SI and NONBOOK. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must 
always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate and the SIl- 
NK marking must be conveyed in the portion mark. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): NK information may 
be sourced in accordance with relevant IC policy and/or procedures. See above precedence and commingling rules. 
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286 


UNCLASSIFIED/ /=6ee— 


(U) Notional Example Page: 


TOP SECRET// SI-NK//REL TO USA, CAN, GBR 


(TS// SI-NK//REL) This is the portion mark for a portion that is classified TOP SECRET, contains NK and SI 
information, and is authorized for release to Canada (CAN) and United Kingdom (GBR). This portion is marked 
for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET// SI-NK//REL TO USA, CAN, GBR 
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286 
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UNCLASSIFIED//Fee— 


(U) Authorized Banner Line Marking Title: TALENT KEYHOLE 
(U) Authorized Banner Line Abbreviation: TK 

(U) Authorized Portion Mark: TK 

(U) Example Banner Line: SECRET//TK 

(U) Example Portion Mark: (S//TK) 


(U) Marking Sponsor/Policy Basis: DNI/White House Memorandum of Aug 26, 1960 


(U) Definition: Talent Keyhole (TK) is an SCI control system designed to protect information and activities related to 
space-based collection of imagery, signals, measurement and signature intelligence, certain products, processing, 
and exploitation techniques, and the design, acquisition and operation of reconnaissance satellites. 


(Osaa) (3) 50 U.S.C. 3024: 

FS eee 
ee 
FS —$—S 
e 


(U) Further Guidance: 


ICD 703 Protection of Classified National Intelligence, Including Sensitive Compartmented Information 
ICD 710 

ICD 906 Controlled Access Program 

ICD 503 Information Technology Systems Security Risk Management, Certification and Accreditation 
NSGI 3801 TALENT-KEYHOLE Control System 

NSG PM 3802 Closure of KLONDIKE (KDK) Control System 

National System for GEOINT (NSG) GEOINT Security Classification Guide 

Integrated NRO Classification Guide (INCG) 1.0 

Signals Intelligence Security Regulation 


Ee = 8 © 8 8 8 E Ñ 


(U) Applicability: Agency specific. 
(U) Additional Marking Instructions: Applicable only to Top Secret and Secret information. 


(U) Neat onsa pi] to Other Markings: 
May only be used with TOP SECRET or SECRET. 
= May require RSEN for imagery product. 
= When incorporating legacy material marked “KLONDIKE” into a new product, re-mark the new document and 
associated portions according to the instructions in the TK-BLFH, TK-IDIT, and TK-KAND marking templates. 
However, legacy information previously marked KDK and transmitted via machine-to-machine processes may 
retain the KDK marking without requiring translation to a TK sub-compartment. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must 
always appear in the banner line. 


UNCLASSIFIED//rex*— 
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(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate and the TK 
marking must be conveyed in the portion mark. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): TK information may 
be sourced in accordance with relevant policy and/or procedures. See above precedence and commingling rules. 


(U) Notional Example Page: 


SECRET//TK//RELIDO 


(S//TK//RELIDO) This is the portion mark for a portion that is classified SECRET, contains TALENT KEYHOLE 


information, and the originator has explicitly deferred the foreign disclosure and release determination to a SFDRA. 
This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//TK//RELIDO 
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(U) Marking Title: BLUEFISH 

(U) Authorized Banner Line Abbreviation: BLFH 

(U) Authorized Portion Mark: BLFH 

(U) Example Banner Line: TOP SECRET//TK-BLFH//NOFORN 
(U) Example Portion Mark: (TS//TK-BLFH//NF) 

(U) Marking Sponsor/Policy Basis: DNI/TK Policy 


(U) Definition: A TALENT KEYHOLE (TK) compartment. 
(U) Further Guidance: 


= ICD 703 Protection of Classified National Intelligence, Including Sensitive Compartmented 
Information 

= 1ICD710 

= ICD 906 Controlled Access Program, 

= ICD 503 Information Technology Systems Security Risk Management, Certification and 
Accreditation 

= NSGI 3801 TALENT-KEYHOLE Control System 

= NSG PM 3802 Closure of KLONDIKE (KDK) Control System 

= BLUEFISH (BLFH) Compartment Security Classification Guide 

= National System for GEOINT (NSG) GEOINT Security Classification Guidance 


(U) Applicability: Agency specific. 


(U) Additional Marking Instructions: 
= Applicable only to Top Secret information. 
= May require RSEN for imagery product. 


(U) pee one ee) to Other Markings: 

May only be used with TOP SECRET 

= Requires TK. 

= Requires NOFORN. 

= When incorporating legacy material marked KDK-BLUEFISH into a new product, re-mark the new 
document and associated portions according to the instructions in this marking template. Legacy 
information previously marked KDK-BLUEFISH and transmitted via machine-to-machine 
processes may retain the KDK marking without requiring translation to a TK sub-compartment. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion 
marks must always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other caveated information when 
appropriate and the TK-BLFH marking must be conveyed in the portion mark. 
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UNCLASSIFIED/ /#636e— 
(U) Derivative Use (re-use of information in whole or in part into intelligence products): TK-BLFH 


information may be sourced in accordance with relevant IC policy and/or procedures. See above 
precedence and commingling rules. 


(U) Notional Example Page: 


TOP SECRET//TK-BLFH//NOFORN 


(TS//TK-BLFH//NF) This is the portion mark for a portion that is classified TOP SECRET, contains TALENT 


KEYHOLE-BLUEFISH information, and is not releasable to foreign nationals. This portion is marked for training 
purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//TK-BLFH//NOFORN 
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UNCLASSIFIED/ /=6ese— 


(U) Authorized Banner Line Marking Title: BLUEFISH [SUB-COMPARTMENT] (up to 6 
alphanumeric characters) 

(U) Authorized Banner Line Abbreviation: BLFH [SUB-COMPARTMENT] (up to 6 alphanumeric 
characters) 

(U) Authorized Portion Mark: BLFH [SUB-COMPARTMENT] (up to 6 alphanumeric 
characters) 

(U) Example Banner Line: TOP SECRET//TK-BLFH ABCD//NOFORN 

(U) Example Portion Mark: (TS//TK-BLFH ABCD//NF) 

(U) Marking Sponsor/Policy Basis: DNI/TK Policy 


(U) Definition: A TALENT KEYHOLE (TK)-BLFH sub-compartment. 


(U) Further Guidance: 


ICD 703 Protection of Classified National Intelligence, Including Sensitive Compartmented 
Information 

ICD 710 

ICD 906 

ICD 503 

NSGI 3801 TALENT-KEYHOLE Control System 

NSG PM 3802 Closure of KLONDIKE (KDK) Control System 

BLUEFISH (BLFH) Sub-compartment Security Classification Guide 

National System for GEOINT (NSG) GEOINT Security Classification Guidance 


(U) Applicability: Agency specific. 


(U) Additional Marking Instructions: 


Refer to applicable BLFH Sub-compartment Security Classification Guide for additional marking 
instructions. 


(U) peeve pe) to Other Markings: 


May only be used with TOP SECRET 

Requires TK-BLFH. 

Requires NOFORN. 

When incorporating legacy material marked KDK-BLUEFISH [SUB-COMPARTMENT] into a new 
product, re-mark the new document and associated portion according to the instructions in this 
marking template. Legacy information previously marked KDK-BLUEFISH [SUB-COMPARTMENT] 
and transmitted via machine-to-machine processes may retain the KDK marking without requiring 
translation to a TK sub-compartment. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion 
marks must always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate 
and the TK-BLFH sub-compartment marking must be conveyed in the portion mark. 
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(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): TK-BLFH 
sub-compartment information may be sourced in accordance with relevant IC policy and/or procedures. 
See above precedence and commingling rules. 


(U) Notional Example Page 1: 


TOP SECRET//TK-BLFH ABCD//NOFORN 


(TS//TK-BLFH ABCD//NF) This is the portion mark for a portion that is classified TOP SECRET, contains TALENT 
KEYHOLE-BLUEFISH ABCD information, and is not releasable to foreign nationals. This portion is marked for 
training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//TK-BLFH ABCD//NOFORN 


(U) Notional Example Page 2: 


TOP SECRET//TK-BLFH ABCD-IDIT//NOFORN 


(TS//TK-BLFH ABCD//NF) This is the portion mark for a portion that is classified TOP SECRET, contains TALENT 
KEYHOLE-BLUEFISH ABCD information, and is not releasable to foreign nationals. This portion is marked for 
training purposes only. 


(TS//TK-IDIT//NF) This is the portion mark for a portion that is classified TOP SECRET, contains TALENT 
KEYHOLE-IDITAROD information, and is not releasable to foreign nationals. This portion is marked for training 
purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//TK-BLFH ABCD-IDIT//NOFORN 
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(U) Marking Title: IDITAROD 

(U) Authorized Banner Line Abbreviation: IDIT 

(U) Authorized Portion Mark: IDIT 

(U) Example Banner Line: TOP SECRET//TK-IDIT//NOFORN 
(U) Example Portion Mark: (TS//TK-IDIT//NF) 

(U) Marking Sponsor/Policy Basis: DNI/TK Policy 


(U) Definition: A TALENT KEYHOLE (TK) compartment. 


(U) Further Guidance: 


ICD 703 Protection of Classified National Intelligence, Including Sensitive Compartmented 
Information 

ICD 710 

ICD 906 

ICD 503 

NSGI 3801 TALENT-KEYHOLE Control System 

NSG PM 3802 Closure of KLONDIKE (KDK) Control System 

IDITAROD (IDIT) Compartment Security Classification Guide 

National System for GEOINT (NSG) GEOINT Security Classification Guidance 


(U) Applicability: Agency specific. 


(U) Additional Marking Instructions: 


Applicable only to Top Secret and Secret information. 


(U) eran ups) to Other Markings: 


May only be used with TOP SECRET or SECRET. 

Requires TK 

Requires NOFORN. 

When incorporating legacy material marked KDK-IDITAROD into a new product, re-mark the new 
document and associated portions according to the instructions in this marking template. Legacy 
information previously marked KDK-IDITAROD and transmitted via machine-to-machine 
processes may retain the KDK-IDITAROD marking without requiring translation to a TK sub- 
compartment. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion 
marks must always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate 
and the TK-IDIT marking must be conveyed in the portion mark. 
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(U) Derivative Use (re-use of information in whole or in part into intelligence products): TK-IDIT 


information may be sourced in accordance with relevant IC policy and/or procedures. See above 
precedence and commingling rules. 


(U) Notional Example Page: 


TOP SECRET//TK-IDIT//NOFORN 


(TS//TK-IDIT//NF) This is the portion mark for a portion that is classified TOP SECRET, contains TALENT 


KEYHOLE-IDITAROD information, and is not releasable to foreign nationals. This portion is marked for training 
purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//TK-IDIT//NOFORN 
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UNCLASSIFIED/ /=6ese— 


(U) Authorized Banner Line Marking Title: IDITAROD [SUB-COMPARTMENT] (up to 6 alphanumeric 


(U) Authorized Banner Line Abbreviation: 


(U) Authorized Portion Mark: 


characters) 


IDIT [SUB-COMPARTMENT] (up to 6 alphanumeric 
characters) 


IDIT [SUB-COMPARTMENT] (up to 6 alphanumeric 


characters) 
(U) Example Banner Line: TOP SECRET//TK-IDIT ABCD//NOFORN 
(U) Example Portion Mark: (TS//TK-IDIT ABCD//NF) 
(U) Marking Sponsor/Policy Basis: DNI/TK Policy 


(U) Definition: A TK-IDITAROD (IDIT) sub-compartment. 


(U) Further Guidance: 


ICD 703 

ICD 710 

ICD 906 

ICD 503 

NSGI 3801 TALENT-KEYHOLE Control System 

NSG PM 3802 Closure of KLONDIKE (KDK) Control System 

IDITAROD (IDIT) Sub-Compartment Security Classification Guide 

National System for GEOINT (NSG) GEOINT Security Classification Guidance 


(U) Applicability: Agency specific. 


(U) Additional Marking Instructions: 


Applicable only to Top Secret and Secret information. 


(U) PEATE sig to Other Markings: 


May only be used with TOP SECRET or SECRET. 

Requires TK-IDIT. 

Requires NOFORN. 

When incorporating legacy material marked KDK-IDITAROD [SUB-COMPARTMENT] into a new product, re- 
mark the new document and associated portion must be re-marked according to the instructions in this marking 
template. Legacy information previously marked KDK-IDITAROD [SUB-COMPARTMENT] and transmitted via 
machine-to-machine processes may retain the KDK marking without requiring translation to a TK sub- 
compartment. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must 
always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate and the 
TK-IDIT sub-compartment marking(s) must be conveyed in the portion mark. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): TK-IDIT sub- 
compartment information may be sourced in accordance with relevant IC policy and/or procedures. See above 
precedence and commingling rules. 
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(U) Notional Example Page 1: 


TOP SECRET//TK-IDIT ABCD//NOFORN 


(TS//TK-IDIT ABCD//NF) This is the portion mark for a portion that is classified TOP SECRET, contains TALENT 
KEYHOLE-IDITAROD ABCD information, and is not releasable to foreign nationals. This portion is marked for 
training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 


Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//TK-IDIT ABCD//NOFORN 


(U) Notional Example Page 2: 


TOP SECRET//TK-IDIT ABCD-KAND//NOFORN 


(TS//TK-IDIT ABCD//NF) This is the portion mark for a portion that is classified TOP SECRET, contains TALENT 
KEYHOLE-IDITAROD ABCD information, and is not releasable to foreign nationals. This portion is marked for 
training purposes only. 


(TS//TK-KAND//NF) This is the portion mark for a portion that is classified TOP SECRET, contains TALENT 
KEYHOLE-KANDIK information, and is not releasable to foreign nationals. This portion is marked for training 
purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//TK-IDIT ABCD-KAND//NOFORN 
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(U) Marking Title: KANDIK 

(U) Authorized Banner Line Abbreviation: KAND 

(U) Authorized Portion Mark: KAND 

(U) Example Banner Line: TOP SECRET//TK-KAND//NOFORN 
(U) Example Portion Mark: (TS//TK-KAND//NF) 

(U) Marking Sponsor/Policy Basis: DNI/TK Policy 


(U) Definition: A TALENT KEYHOLE (TK) compartment. 


(U) Further Guidance: 
= ICD 703 
ICD 710 
ICD 906 
ICD 503 
NSGI 3801 TALENT-KEYHOLE Control System 
NSG PM 3802 Closure of KLONDIKE (KDK) Control System 
KANDIK (KAND) Compartment Security Classification Guide 
National System for GEOINT (NSG) GEOINT Security Classification Guidance 


(U) Applicability: Agency specific. 


(U) Additional Marking Instructions: 
= Applicable only to Top Secret and Secret information. 


(U) Relationship(s) to Other Markings: 

= May only be used with TOP SECRET or SECRET. 

= Requires TK. 

= Requires NOFORN. 

= When incorporating legacy material marked KDK-KANDIK into a new product, re-mark the new document and 
associated portion according to the instructions in this marking template. Legacy information previously 
marked KDK-KANDIK and transmitted via machine-to-machine processes may retain the KDK marking 
without requiring translation to a TK sub-compartment. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must 
always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate and the TK- 
KAND marking must be conveyed in the portion mark. 


(U) Derivative Use (re-use of information in whole or in part into intelligence products): TK-KAND information 
may be sourced in accordance with relevant IC policy and/or procedures. See above precedence and commingling 
rules 
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hris -document rs mot approved for pubiic tretease. 
(U) Notional Example Page: 


TOP SECRET//TK-KAND//NOFORN 


(TS//TK-KAND//NF) This is the portion mark for a portion that is classified TOP SECRET, contains TALENT 


KEYHOLE-KANDIK information, and is not releasable to foreign nationals. This portion is marked for training 
purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//TK-KAND//NOFORN 
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(U) Authorized Banner Line Marking Title: KANDIK [SUB-COMPARTMENT] (up to 6 alphanumeric 
. characters) 
KAND [SUB-COMPARTMENT] (up to 6 alphanumeric 


(U) Authorized Banner Line Abbreviation: 
characters) 


(U) Authorized Portion Mark: KAND [SUB-COMPARTMENT] (up to 6 alphanumeric 


characters) 
(U) Example Banner Line: TOP SECRET//TK-KAND ABCD//NOFORN 
(U) Example Portion Mark: (TS//TK-KAND ABCD//NF) 
(U) Marking Sponsor/Policy Basis: DNI/TK Policy 


(U) Definition: A TK-KAND sub-compartment. 


(U) Further Guidance: 
= ICD 703 
ICD 710 
ICD 906 
ICD 503 
NSGI 3801 TALENT-KEYHOLE Control System 
NSG PM 3802 Closure of KLONDIKE (KDK) Control System 
KANDIK (KAND) Sub-compartment Security Classification Guide 
National System for GEOINT (NSG) GEOINT Security Classification Guidance 


(U) Applicability: Agency specific. 


(U) Additional Marking Instructions: 
= Applicable only to Top Secret and Secret information. 


(U) SAONE to Other Markings: 
May only be used with TOP SECRET or SECRET. 
= Requires TK-KAND. 
= Requires NOFORN. 
= When incorporating legacy material marked KDK-KANDIK [SUB-COMPARTMENT] into a new product, re-mark 
the new document and associated portion must according to the instructions in this marking template. Please 
reference section F, Legacy Control Markings for additional guidance. 


(U) Precedence Rules for Banner Line Guidance: All unique SCI markings contained in the portion marks must 
always appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate and the TK- 
KAND sub-compartment marking(s) must be conveyed in the portion mark. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): TK-KAND sub- 
compartment information may be sourced in accordance with relevant IC policy and/or procedures. See above 
precedence and commingling rules. 
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(U) Notional Example Page 1: 


TOP SECRET//TK-KAND ABCD//NOFORN 


(TS//TK-KAND ABCD//NF) This is the portion mark for a portion that is classified TOP SECRET, contains TALENT 
KEYHOLE-KANDIK ABCD information, and is not releasable to foreign nationals. This portion is marked for 
training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//TK-KAND ABCD//NOFORN 


(U) Notional Example Page 2: 


TOP SECRET//TK-IDIT-KAND ABCD//NOFORN 


(TS//TK-KAND ABCD//NF) This is the portion mark for a portion that is classified TOP SECRET, contains TALENT 
KEYHOLE-KANDIK ABCD information, and is not releasable to foreign nationals. This portion is marked for 
training purposes only. 


(TS//TK-IDIT//NF) This is the portion mark for a portion that is classified TOP SECRET, contains TALENT 
KEYHOLE-IDITAROD information, and is not releasable to foreign nationals. This portion is marked for training 
purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//TK-IDIT-KAND ABCD//NOFORN 
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5. (U) Special Access Program Markings 


(U) Special Access Program (SAP) markings denote classified information that requires extraordinary protection as 
allowed by EO 13526. 


(U) SAP markings take the form: 
= SPECIAL ACCESS REQUIRED-[program identifier] or abbreviated as SAR-[program identifier abbreviation] 


(U) A program identifier is the program's assigned nickname, codeword, or abbreviation. SAR program identifiers are 
alphanumeric values. Multiple SAR program identifiers may be applied if applicable. Multiple program identifiers are 
listed in ascending sort order with numbered values first, followed by alphabetic values. When multiple SAR values are 
used, the marking takes the form: 


= /SPECIAL ACCESS REQUIRED-[program identifier]-[compartment] [sub-compartment]/[program identifier], or 
abbreviated as 

= //SAR-[program identifier abbreviation]-[compartment] [sub-compartment]/[program identifier abbreviation]. 
Example: SECRET//SAR-XXX-YYY 123/ZZZ. 


(U) A SAP may contain compartments and sub-compartments to further protect and/or distinguish information within the 
program. Within each hierarchical level, multiple values are listed in ascending sort order with numbered values first, 
followed by alphabetic values. Figure 5 illustrates the basic hierarchical structure of a SAP. All markings in Figure 5 are 
fictitious. Depiction of the hierarchical structure of a SAP below the program identifier in the banner line or portion mark is 
optional. 


(U) This figure is UNCLASSIFIED. 


SAP Program 
(e.g., BP) 


Compartment 
(e.g., 121) 


Compartment 
(e.g., A12) 


Sub-compartment 
(e.g., 125) 


Sub-compartment 
(e.g., CDE) 


Sample banner line SAP category as depicted: //SAR-BP-121-A12 125 CDE// 


Figure 5: (U) Optional SAP Hierarchical Structure 
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(U) For the purpose of succinctness in the banner and portion mark, the IC SAP Marking Standard is not intended to show 
direct hierarchy/structure beyond or beneath the sub-compartment level. To display a program beyond the sub- 
compartment level, move the subordinate program up to the sub-compartment level and list the sub-compartment(s) in 
alphanumeric order. In this manner, the relationship to the compartment will be shown, but because the sub- 
compartments are listed alphanumerically, direct hierarchy of the sub-compartment(s) will not be shown. Refer to the 
syntax rules below and Table 7 for additional guidance and a marking sample. 


(U) All SAP programs and compartments/sub-compartments are unpublished. For all SAP markings, use the following 
syntax rules for both portion marks and banner lines: 


= Use a double forward slash (“//”) to separate the SAP category from the preceding category (i.e., Classification or 
SCI). 

= The first value in the SAP category will be the SAP category indicator, either “SPECIAL ACCESS REQUIRED-” or 
“SAR-” (authorized abbreviation). 

= The hyphen appearing with the SAP category indicator is not a marking separator; it is considered part of the SAP 
category indicator for marking syntax purposes. 

= If multiple SAP program identifiers are applicable, each subsequent program identifier must be listed in ascending 
sort order with numbered values first, followed by alphabetic values, and separated by a single forward slash (“/”) 
without interjected spaces. 

= The SAP category indicator must not be repeated if multiple SAP programs are applicable. 

= Compartment(s) (if any), must be kept with the SAP program identifier, listed in ascending sort order with 
numbered values first, followed by alphabetic values, and separated by a hyphen ("-") without interjected spaces. 

= Sub-compartment(s) (if any), must be kept with the compartment, listed alphanumerically, and separated by a 
single space. 


(U) Note: Reflecting SAP program/control system hierarchy below the program/control system level in the portion or 
banner markings is optional and based on operational requirements. 


(U) The sample banner below illustrates the syntax rules for the SAP Control Marking category. The separators have 
been enlarged and bolded for illustrative purposes. Note: The first hyphen is not bold as it is part of the SAP category 
identifier and not considered a marking separator. Refer to Table 7 below for a listing of each marking category and 
marking used in the sample: 


SECRET//SAR-BP=J12 J54=*K15/CD=YYY 456 689/XR=XRA RB//NOFORN 


Table 7: (U) SAP Sample Banner Marking Categories and Markings 
(U) This table is UNCLASSIFIED. 


US Classification Level SECRET 


BP is a SAP program 

CD is a SAP program 

XR is a SAP program 

J12 is a compartment of BP 

K15 is a compartment of BP 

YYY is a compartment of CD 

XRA is a compartment of XR 

J54 is a sub-compartment of J12 under BP 
456 is a sub-compartment of YYY under CD 
689 is a sub-compartment of YYY under CD 
RB is a sub-compartment of XRA under XR 


SAP Programs 


SAP Compartments 


SAP Sub-Compartments 


Dissemination Control Markings NOFORN 
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(U) Authorized Banner Line Marking Title: SPECIAL ACCESS REQUIRED-[program identifier] 
(U) Authorized Banner Line Abbreviation: SAR-[program identifier] or SAR-[program identifier abbreviation] 
(U) Authorized Portion Mark: SAR-[program identifier abbreviation] 
(U) Example Banner Line: TOP SECRET//SAR-BUTTER POPCORN 
or 


TOP SECRET//SAR-BP 


(U) Example Banner Line with Multiple SARs: TOP SECRET//SAR-BUTTER POPCORN/SODA 
or 
TOP SECRET//SAR-BP/SDA 


(U) Example Portion Mark: (TS//SAR-BP) 
(U) Marking Sponsor/Policy Basis: DNI, DoD, DOE, DoS, DHS, Attorney General/EO 13526, §4.3 


(U) Definition: SAP markings denote classified information that requires extraordinary protection as allowed by EO 
13526. A program identifier is a program's assigned nickname, codeword, or abbreviation. 


(U) Further Guidance: 
= DoDM 5200.01-V2, Feb 24, 2012 
= DOE 471.2 
= 1ICD710 


(U) Applicability: Agency specific. 


(U) Additional Marking Instructions: 
= Applicable only to classified information. 
= Program identifiers may be spelled out or abbreviated. 
= A program identifier abbreviation is the two or three-character designator for the program. 


(U) Relationship(s) to Other Markings: May only be used with TOP SECRET, SECRET, or CONFIDENTIAL. 


(U) Precedence Rules for Banner Line Guidance: Unique SAPs contained in portion marks must always appear in 
the banner line. 


(U) Notes: Depicting the hierarchical structure of a SAP program below the program identifier is optional and 
dependent upon operational requirements. It is not mandatory to reflect a SAP program’s hierarchy in either the 
portion marks or banner line. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): When sourcing from 
non-IC originated SAP material without FD&R markings, in the absence of a formal agreement or notification between 
the non-IC organization and the IC element on handling requirements, mark SAP portions as NOFORN when an 
FD&R marking is required as described in Section B.3., paragraph a., FD&R for IC Disseminated Analytic Products 
(DAPs) of this document. 
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(U) Notional Example Page: 


TOP SECRET//SAR-BP//NOFORN 
(TS//SAR-BP//NF) This is the portion mark for a portion that is classified TOP SECRET, contains SPECIAL 


ACCESS REQUIRED-BUTTER POPCORN information, and is not releasable to foreign nationals. “BP” is the 


abbreviation for the BUTTER POPCORN program identifier in this example. This portion is marked for training 
purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//SAR-BP//NOFORN 


102 
UNCLASSIFIED//re*xs— 


304 


305 


UNCLASSIFIED/ /=6ee— 
6. (U) Atomic Energy Act Information Markings 


(U) Atomic Energy Act (AEA) information markings are used in US products to denote the presence of information that is 
marked Restricted Data (RD), Formerly Restricted Data (FRD), and/or Transclassified Foreign Nuclear Information 
(TFNI), and/or unclassified DoD Unclassified Controlled Nuclear Information (DOD UCNI) and DOE Unclassified 
Controlled Nuclear Information (DOE UCNI). 


(U) Restricted Data is information concerning: (1) the design, manufacture, or utilization of atomic weapons; (2) the 
production of special nuclear material; or (3) the use of special nuclear material in the production of energy, except for that 
information that has been declassified or removed from the RD category under Section 142 of the AEA, as determined by 
the Department of Energy (DOE). Formerly Restricted Data is information concerning: military utilization of atomic 
weapons that has been removed from the RD category under Section 142d of the AEA. Transclassified Foreign Nuclear 
Information is that concerning the atomic energy programs of other nations, which has been removed from the RD 
category (per ISOO Implementing Directive 32 CFR 2001,§ 2001.24(i), and instructions provided by DOE and ISOO 
(ISOO Notice 2011-02) for use by the Intelligence Community and is safeguarded as NSI under EO 13526. When RD 
information is transclassified and is safeguarded as NSI, it is marked “TFNI” and is handled, protected, and classified 
under the provisions of EO 13526 and the ISOO Implementing Directive. 


(U) Atomic Energy Act information is classified and controlled under the Atomic Energy Act, as amended, and 
10CFR1045. NSI is classified and controlled by Presidential Order in EO 13526 and the ISOO Implementing Directive. 
Pursuant to 1OCFR1045, the DOE “manages the Government-wide system for the classification and declassification of 
RD and FRD in accordance with the Atomic Energy Act.” DOE is the classification and declassification authority for all RD 
information and shares joint classification and declassification authority with DoD for all FRD information. The 
declassification process for TFNI is governed by the Secretary of Energy under the Atomic Energy Act. 


(U) The automatic declassification of documents containing RD or FRD information is prohibited. Per ISOO, to the extent 
practicable, avoid commingling RD or FRD information with NSI classified under EO 13526. When it is not practicable to 
avoid such commingling, follow the marking requirements in EO 13526, the ISOO Implementing Directive and ISOO 
Notice 2011-02, as well as the marking requirements in 10CFR1045. If a classified document contains both AEA 
information and NSI, the “Declassify On” line of the classification authority block must not include a declassification date 
or event. It must, instead, be annotated with “N/A to RD/FRD/TFNI portions. See source list for NSI portions.” The NSI 
source list, as described in ISOO Implementing Directive, Section 2001.22(c), must include the declassification 
instructions for each of the source documents classified under EO 13526. 


(U) The AEA information markings included in the Register are: 


= RESTRICTED DATA (RD) 

e CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) 

e SIGMA (SIGMA) 
= FORMERLY RESTRICTED DATA (FRD) 

e SIGMA (SIGMA) 
"= DOD UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION (DOD UCNI) 
» DOE UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION (DOE UCNI) 
= TRANSCLASSIFIED FOREIGN NUCLEAR INFORMATION (TENI) 
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(U) Authorized Banner Line Marking Title: RESTRICTED DATA 


(U) Authorized Banner Line Abbreviation: RD 


(U) Authorized Portion Mark: RD 

(U) Example Banner Line: SECRET//RESTRICTED DATA 

(U) Example Portion Mark: (S//RD) 

(U) Marking Sponsor/Policy Basis: DOE/ Atomic Energy Act of 1954, as amended, §141-143 


(U) Definition: All data concerning (1) design, manufacture, or utilization of atomic weapons; (2) the production of special 
nuclear material; or (3) the use of special nuclear material in the production of energy, but must not include data 
declassified or removed from the Restricted Data category pursuant to Section 142 of the Atomic Energy Act of 1954, as 
amended. 


(U) Further Guidance: 
= 10CFR1045 
EO 13526, §3.3(g) and 6.2(a) 
ISOO Implementing Directive, 32CFR2001, §2001.24 (h), §2001.30 (p) and §2001.34 (b) (8) 
DOE Order 475.2B, Identifying Classified Information 
DOE Order 452.8, Control of Nuclear Weapon Data 


(U) Applicability: DOE is the proponent. Other IC agencies are designated on a case-by-case basis, by joint classification 
guides for the specific RD subject matter. 


(U) Additional Marking Instructions: 

= Applicable only to classified information. 

= DOE documents that solely contain DOE material must record the identity of the classifier and the classification 
guide or source document title and date used to classify the document on the first page (10CFR1045). 

= Automatic declassification of documents containing RD information is prohibited. If a document contains both RD 
information and NSI, the “Declassify On” line of the classification authority block must not include a declassification 
date or event, and must instead be annotated with “N/A to RD portions. See source list for NSI portions.” 

= The NSI source list, as described in ISOO Implementing Directive, Section 2001.22(c), must include the 
declassification instruction for each of the source documents classified under EO 13526. 


(U) eee to Other Markings: 
May only be used with TOP SECRET, SECRET, or CONFIDENTIAL. 
= Is always used with NOFORN unless a sharing agreement has been established per the Atomic Energy Act. (Ref. 
Sections 123 and 144 of the Atomic Energy Act, and DoD Instruction 5030.14.) 
= _CNWDI can only be used with RD as designated by DOE or joint DOE-DoD guidance. 
= SIGMA 14, 15, 18, and 20 can only be used with TOP SECRET and SECRET RD in accordance with DOE Order 
452.8. 


(U) Precedence Rules for Banner Line Guidance: 

= If the RD marking is contained in any portion of a document, it must appear in the banner line. 
If RD, FRD, and TFNI portions are in a document, the RD takes precedence and is conveyed in the banner line. In this 
case, use only the RD warning statement. 
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(U) Commingling Rule(s) Within a Portion: 
= Where possible, RD should be separated into a separate annex. If not possible, the RD marking must be indicated 
in the portion mark. 
= |f RD information is commingled with FRD and/or TFNI information in the same portion, only RD is used in the 
portion mark. RD takes precedence over FRD and TFNI in the portion mark. 


(U) Notes: 
«DOE is the classification and declassification authority for all RD information and manages the government-wide 
RD classification and declassification system. 
= RD is not releasable to foreign nationals/governments unless authorized. Contact the Joint Atomic Energy 
Information Exchange Group (JAE|G) (GG 50 U:S.C. 3024) if a foreign disclosure/release determination is needed. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): RD information may be 
sourced provided that: 
= The source document is portion marked. i 
= Contact the Joint Atomic Information Exchange Group ANZA] O) 50 U.S.C. hen a foreign 
disclosure/release determination is needed. 
=  |tis recommended that the RD portion be placed in a separate attachment/appendix. 
= Automatic declassification of documents containing RD information is prohibited. If a document contains both RD 
information and NSI, the “Declassify On” line of the classification authority block must not include a declassification 
date or event, and must instead be annotated with “N/A to RD portions. See source list for NSI portions’. 
= The derivative classifier authorizing the marking must be trained in accordance with 10CFR1045. 


(U) Warnings and Notices: 
= All documents containing RD information must include the following RD warning statement on the first page: “(U) 
RESTRICTED DATA: This document contains Resiricted Data as defined in the Atomic Energy Act of 1954, 
as amended. Unauthorized disclosure is subject to Administrative and Criminal Sanctions.” 
= |f an RD document also contains FRD, only the RD warning statement must be used. 
= |f an RD document also contains CNWDI, the CNWDI identifying statement must not be included in the same text 
box as the RD warning statement, but displayed separately on the first page. 


(U) Notional Example Page: 


SECRET//RESTRICTED DATA//NOFORN 


(S//RD//NF) This is the portion mark for a portion that is classified SECRET and contains RESTRICTED DATA, and is 
not releasable to foreign nationals. This portion is marked for training purposes only. 


(S//NF) This is the portion mark for a portion of NSI that is classified SECRET and is not releasable to foreign 
nationals. This portion is marked for training purposes only. 


[Insert RD Warning] 


(U) Note: Automatic declassification of documents containing RD information is prohibited. If a document contains both 
RD information and NSI, the “Declassify On” line of the classification authority block must not include a declassification 
date or event, and must be annotated instead with “N/A to RD portions. See source list for NSI portions.” 


SECRET//RESTRICTED DATA//NOFORN 
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(U) Authorized Banner Line Marking Title: CRITICAL NUCLEAR WEAPON DESIGN INFORMATION 
(U) Authorized Banner Line Abbreviation: CNWDI 

(U) Authorized Portion Mark: CNWDI 

(U) Example Banner Line: SECRET//RD-CNWDI 

(U) Example Portion Mark: (S//RD-CNWDI) 

(U) Marking Sponsor/Policy Basis: DoD/ DoD 5210.2 


(U) Definition: TOP SECRET or SECRET Restricted Data (RD) information revealing the theory of operation or 
design of the components of a fission or thermonuclear bomb, warhead, demolition munitions, or test device. 
Specifically excluded are: information concerning arming, fusing, and firing systems; limited-life components; and 
total contained quantities of fissionable, fusionable, and high-explosive materials by type. Among these excluded 
items are the components that DoD personnel set, maintain, operate, test, or replace. 


(U) Further Guidance: 
= DoDM 5200.01-V2, Feb 24, 2012 
= DoD 5210.02 
= DOE Order 452.8, Control of Nuclear Weapon Data 


(U) Applicability: DoD components/contractors and properly cleared personnel of other Federal Agencies. 


(U) Additional Marking Instructions: Applicable only to Top Secret or Secret RD information. 


(U) Relationship(s) to Other Markings: 
= May only be used with TOP SECRET RD or SECRET RD. 
= Must be used as a subset of RD in accordance with DOD or joint DOE-DoD guidance. 


(U) Precedence Rules for Banner Line Guidance: If the CNWDI marking is contained in any portion of a 
document, it must appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: CNWDI-marked information must be segregated from classified NSI 
portions. 


(U) Notes: 

«Dissemination of Restricted Data to any nation or regional defense organization or to a representative 
thereof is prohibited except in accordance with the AEA. 

= DOE is the classification and declassification authority for all RD information. 

= Automatic declassification of documents containing RD information is prohibited. If a document contains 
both RD-CNWDI information and NSI, the “Declassify On” line of the classification authority block must not 
include a declassification date or event, and must instead be annotated with “N/A to RD portions. See 
source list for NSI portions.” 

= The NSI source list, as described in ISOO Implementing Directive, Section 2001.22(c), must include the 
declassification instruction for each of the source documents classified under EO 13526. 
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(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): RD information may be 
sourced provided that: 

e The source document is portion marked. 

e Itis recommended that the RD-CNWDI portion be placed in a separate attachment/appendix. 

e Contact the Joint Atomic Information Exchange Group VAIEG) OC 0 USC. SOANA a foreign 
disclosure/release determination is needed. 

e Automatic declassification of documents containing RD-CNWDI information is prohibited. If a document contains 
both RD-CNWDI information and NSI, the “Declassify On” line of the classification authority block must not 
include a declassification date or event, and must instead be annotated with “N/A to RD portions. See source list 
for NSI portions." 

e The derivative classifier authorizing the marking must be trained and designated as an RD Classifier in 
accordance with 10CFR1045. 

e IAW DoD Policy, DoD marks both banner line and portion mark as "-N" appended to the RD marking (i.e., banner 
would be marked as “RESTRICTED DATA-N” and portion mark would be marked as “RD-N”. When sourcing, re- 
mark “N” as “CNWDI”. 


(U) Warnings and Notices: 
= All documents containing CNWDI information are required to include the following identifying statement placed on 
the first page: “Critical Nuclear Weapons Design Information. DoD Instruction 5210.02 Applies.” 
= All documents containing RD information are required to include the following RD warning statement on the first 
page: “(U) RESTRICTED DATA: This document contains Restricted Data as defined in the Atomic Energy 
Act of 1954, as amended. Unauthorized disclosure is subject to Administrative and Criminal Sanctions.” 


(U) Notional Example Page: 


SECRET//RD-CNWDI//NOFORN 


(S//RD-CNWDI//NF) This is the portion mark for a portion that is classified SECRET, Restricted Data-Critical 
Nuclear Weapon Design Information (CNWD)), and is not releasable to foreign nationals. This portion is marked 
for training purposes only. 


(S//NF) This is the portion mark for a portion of NSI that is classified SECRET and is not releasable to foreign 
nationals. This portion is marked for training purposes only. 


[Insert RD Warning] 

[Insert CNWDI Statement] 

(U) Note: Automatic declassification of documents containing RD information is prohibited. If a document contains 
both RD-CNWDI information and NSI, the “Declassify On” line of the classification authority block must not include a 


declassification date or event, and must be annotated instead with “N/A to RD portions. See source list for NSI 
portions.” 


SECRET//RD-CNWDI//NOFORN 
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(U) Authorized Banner Line Marking Title: SIGMA [#] 

(U) Authorized Banner Line Abbreviation: None 

(U) Authorized Portion Mark: SG H] 

(U) Example Banner Line: SECRET//RD-SIGMA 20 
(U) Example Portion Mark: (S//RD-SG 20) 


(U) Example Banner Line with multiple SIGMAs: ©SECRET//RD-SIGMA 18 20 


(U) Marking Sponsor/Policy Basis: DOE/Atomic Energy Act of 1954, as amended, §141-143 


(U) Definition: A subset of TOP SECRET and SECRET RD information relating to the design, manufacture, or use 
(including theory, development, storage, characteristics, performance, and effects) of atomic weapons or atomic 
weapon components. This includes information incorporated in or relating to nuclear explosive devices. SIGMAs 
provide a structure for limiting authorized access to weapons information to only those who have a need to know for 
a specific category of RD. The current categories of the nuclear weapon data described above are SIGMA 14, 
SIGMA 15, SIGMA 18, and SIGMA 20. 


(U) Further Guidance: 
=  10CFR1045, Nuclear Classification and Declassification 
EO 13526, §3.3(g) and 6.2(a) 
ISOO Implementing Directive, 32CFR2001, §2001.24 (h), §2001.30 (p) and §2001.34 (b) (8) 
DOE Order 475.2B, Identifying Classified Information 
DOE Order 452.8, Control of Nuclear Weapon Data 


(U) Applicability: DOE is the proponent. Other IC agencies are designated on a case-by-case basis, by joint 
classification guides for the specific RD subject matter. 


(U) Additional Marking Instructions: 

= Applicable only to Top Secret and Secret RD information. 

= SIGMA # currently represents one or more of the following numbers: 14, 15, 18, and 20. 

= Multiple SIGMA numbers must be listed in numerical order with a space preceding each value. 

= Automatic declassification of documents containing RD information is prohibited. If a document contains 
both AEA information and NSI, the “Declassify On” line of the classification authority block must not include a 
declassification date or event, and must be annotated instead with “N/A to RD portions. See source list for 
NSI portions.” 


(U) Relationship(s) to Other Markings: 
= May only be used with TOP SECRET or SECRET. 
= Requires RD in accordance with DOE or joint DOE-DoD guidance. 


(U) Precedence Rules for Banner Line Guidance: 
= — If the SIGMA marking is contained in any portion of a document, it must appear in the banner line with all 
unique SIGMA numbers identified in the portion marks. 
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If both RD and FRD SIGMA [#] portions are in a document, the RD-SIGMA [#] marking takes precedence over the 
FRD-SIGMA [#] marking in the banner line and all SIGMA numbers are listed in the RD-SIGMA [#] marking in the 
banner line, regardless of whether the information was RD or FRD. 


(U) commingling Rule(s) Within a Portion: 

Where possible, SIGMA-marked information should be separated into a separate annex. If not possible, RD- 
SG [#] must be indicated in the portion mark. 

= RD-SIGMA-marked information must not be commingled in the same portion that has a REL TO portion 
unless an equivalent positive release determination has been made. 

= If both RD and FRD SIGMA [#] information are in the same portion, the RD-SIGMA [#] marking takes 
precedence over the FRD-SIGMA [#] marking in the portion mark and all SIGMA numbers are listed in the 
RD-SIGMA [#] marking in the portion mark, regardless of whether the information was RD or FRD. Note: It 
is not required but highly recommended that the RD and FRD SIGMA information is segregated into 
separate portions in a document so the FRD portion can be more readily shared within DoD and other 
government agencies. 


(U) ee 

RD is not releasable to foreign bette tele overnments unless authorized. Contact the Joint Atomic 
Information Exchange Group (JAE|G) OREIN E Zi wen a foreign disclosure/release determination is 
needed. 

= RD information marked with obsolete SIGMAs (1-5 and 9-13) does not require review or re-marking while at 
rest (or when simply accessed). When information containing legacy SIGMAs is to be shared outside the 
originating agency, or if the information is to be incorporated, paraphrased, restated, or reintroduced into the 
working environment from a resting state, the obsolete SIGMAs must not be carried forward to any newly 
created information; rather, they must be converted to the appropriate current SIGMA categories. Check 
with your organization's RD Management Official to determine how to convert the obsolete markings to the 
current SIGMA categories. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): It may be extracted 
provided that: 
= The source document is portion marked. 
= Contact the Joint Atomic Information Exchange Group (JAIEG) at 
disclosure/release determination is needed. 
= _RD-SIGMA information may only be disseminated to persons who have a need-to-know and the appropriate 
clearance and SIGMA access authorization. To determine if a person has the appropriate SIGMA access 
authorization, contact the National Nuclear Security Administration at (b)(3) 50 U.S.C. 30241 
= It is recommended that any RD portions be put in a separate attachment/appendix. 
= Automatic declassification of documents containing RD-SIGMA information is prohibited. If a document 
contains both RD-SIGMA information and NSI, the “Declassify On” line of the classification authority block 
must not include a declassification date or event, and must instead be annotated with “N/A to RD portions. 
See source list for NSI portions.” 


(b)(3) 50 U.S.C. 3024i 
bien when a foreign 


(U) Warnings and Notices: All documents containing RD information are required to include the following RD 
warning statement on the first page: “(U) RESTRICTED DATA: This document contains Restricted Data as 
defined in the Atomic Energy Act of 1954, as amended. Unauthorized disclosure is subject to Administrative 
and Criminal Sanctions.” 


(U) Some SIGMA categories require additional admonition blocks on the first page. Contact the National 
Nuclear Security Administration (b)(3) 50 U. S.C. 3024i or further guidance. 
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(U) Notional Example Page: 


SECRET//RESTRICTED DATA-SIGMA 20//NOFORN 


(S//RD-SG 20//NF) This is the portion mark for a portion that is classified SECRET RESTRICTED DATA, SIGMA 
20, and is not releasable to foreign nationals. This portion is marked for training purposes only. 


(S//NF) This is the portion mark for a portion of NSI that is classified SECRET and is not releasable to foreign 
nationals. This portion is marked for training purposes only. 


[Insert RD Warning] 


(U) Note: Automatic declassification of documents containing RD information is prohibited. If a document contains 
both RD-SIGMA information and NSI, the “Declassify On” line of the classification authority block must not include 
a declassification date or event, and must instead be annotated with “N/A to RD portions. See source list for NSI 
portions.” 


SECRET//RESTRICTED DATA-SIGMA 20//NOFORN 
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(U) Authorized Banner Line Marking Title: FORMERLY RESTRICTED DATA 
(U) Authorized Banner Line Abbreviation: FRD 

(U) Authorized Portion Mark: FRD 

(U) Example Banner Line: SECRET//FRD 

(U) Example Portion Mark: (S//FRD) 


(U) Marking Sponsor/Policy Basis: aF and DoD/Atomic Energy Act of 1954, as amended, §141- 
(U) Definition: Information removed from the Restricted Data category upon a joint determination by the Departments 
of Energy and Defense. Such information relates primarily to the military utilization of atomic weapons and can be 
safeguarded adequately as classified defense information. 


(U) Further Guidance: 
= 10CFR1045, Nuclear Classification and Declassification 
EO 13526, §3.3(g) and 6.2(a) 
ISOO Implementing Directive, 32CFR2001, §2001.24 (h), §2001.30 (p) and §2001.34 (b) (8) 
DOE Order 475.2B, Identifying Classified Information 
DOE Order 471.6, Information Security 
DOE Order 452.8, Control of Nuclear Weapon Data 


(U) Applicability: Agency specific. DOE and DoD are joint proponents. Other agencies are authorized to classify 
FRD provided they follow the provisions in 10CFR1045, which require determinations to be made by appropriately 
trained individuals using classification guidance or source documents. 


(U) Additional Marking Instructions: 
= Applicable only to classified information. 
= DOE documents that solely contain DOE material must record the identity of the classifier and the 
classification guide or source document title and date used to classify the document on the first page 
(10CFR1045). 


(U) Relationship(s) to Other Markings: 
= May only be used with TOP SECRET, SECRET, or CONFIDENTIAL. 
= Is always used with NOFORN unless a sharing agreement has been established per the Atomic 
Energy Act. (Ref. Sections 123 and 144 of the Atomic Energy Act, and DoD Instruction 5030.14.) 


(U) Precedence Rules for Banner Line Guidance: 
= — If the FRD marking is contained in any portion of a document, it must appear in the banner line (except when 
RD is present.) 
= If RD and FRD portions are in a document, the RD marking takes precedence in the banner line and is 
conveyed in the banner line. In this case, only the RD warning statement must be used. 


(U) conning Rule(s) Within a Portion: 
Where possible, FRD should be placed into a separate annex. 
= |f not possible to separate the FRD information, the FRD marking must be indicated in the portion mark, 
except when RD information is also present in the portion then only RD is used in the portion mark. RD takes 
precedence over FRD in the portion mark. 
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(U) esa 

DOE manages the government-wide FRD classification and declassification system. 

"DoD and DOE have joint responsibility for identifying and declassifying FRD. 

= FRD is not releasable to foreign nationals governments | unless authorized. Contact the Joint Atomic Energy 
Information Exchange Group AEC) G, nen a foreign disclosure/release determination is 
needed. 

= Automatic declassification of documents containing FRD information is prohibited. If a document contains 
both FRD information and NSI, the “Declassify On” line of the classification authority block must not include a 
declassification date or event, and must instead be annotated with “N/A to FRD portions. See source list for 
NSI portions.” 

= The NSI source list, as described in ISOO Implementing Directive, Section 2001.22(c), must include the 
declassification instruction for each of the source documents classified under EO 13526. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): FRD may be 
extracted provided that: 

e The source document is portion marked. 

e Contact the Joint Atomic Information Exchange Group (JAIEG) 
disclosure/release determination is needed. 

e It is recommended that the FRD portion be placed in a separate attachment/appendix. 

e Automatic declassification of documents containing FRD information is prohibited. If a document contains 
both FRD information and NSI, the “Declassify On” line of the classification authority block must not include a 
declassification date or event, and must instead be annotated with “N/A to FRD portions. See source list for 
NSI portions.” 

= The derivative classifier authorizing the marking must be trained in accordance with 10CFR1045. 


(b)(3) 50 U.S.C. 30241 hen a foreign 


(U) Warnings and Notices: All documents containing FRD information (but no RD information) are required to include 
the following FRD warning statement on the first page: “(U) FORMERLY RESTRICTED DATA: Unauthorized 
disclosure is subject to administrative and criminal sanctions. Handle as RESTRICTED DATA in foreign 
dissemination. Section 144b, Atomic Energy Act of 1954.” 


(U) Notional Example Page: 
SECRET//FORMERLY RESTRICTED DATA//NOFORN 


(S//FRD//NF) This is the portion mark for a portion that is classified SECRET FORMERLY RESTRICTED DATA, 
and is not releasable to foreign nationals. This portion is marked for training purposes only. 


(S//NF) This is the portion mark for a portion of NSI that is classified SECRET and is not releasable to foreign 
nationals. This portion is marked for training purposes only. 


[Insert FRD Warning] 
(U) Note: Automatic declassification of documents containing FRD information is prohibited. If a document contains 
both FRD information and NSI, the “Declassify On” line of the classification authority block must not include a 


declassification date or event, and must be annotated instead with “N/A to FRD portions. See source list for NSI 
portions.” 


SECRET//FORMERLY RESTRICTED DATA//NOFORN 
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(U) Authorized Banner Line Marking Title: SIGMA [#] 

(U) Authorized Banner Line Abbreviation: None 

(U) Authorized Portion Mark: SG [#] 

(U) Example Banner Line: SECRET//FRD-SIGMA 14 


(U) Example Banner Line with multiple SIGMAs: © SECRET//FRD-SIGMA 14 18 
(U) Example Portion Mark: (S//FRD-SG 14) 
(U) Marking Sponsor/Policy Basis: DOE/Atomic Energy Act of 1954, as amended, §141-143 


(U) Definition: A subset of TOP SECRET and SECRET FRD information relating to nuclear weapon data concerning 
the design, manufacture, or utilization (including theory, development, storage, characteristics, performance, and 
effects) of atomic weapons or atomic weapon components. This includes information incorporated in or relating to 
nuclear explosive devices. SIGMAs provide a structure for limiting authorized access to weapon information to only 
those who have a need-to-know for that specific segment of FRD. The current categories of the nuclear weapon data 
described above are SIGMA 14, SIGMA 15, SIGMA 18, and SIGMA 20. 


(U) Further Guidance: 
= 10CFR1045 
EO 13526, §3.3(g) and 6.2(a) 
ISOO Implementing Directive, 32CFR2001, §2001.24 (h), §2001.30 (p) and §2001.34 (b) (8) 
DOE Order 475.2B, Identifying Classified Information 
DOE Order 452.8, Control of Nuclear Weapon Data 


(U) Applicability: Agency specific. Department of Energy (DOE) is the proponent. Other IC-agencies as designated 
on a case-by-case basis and by joint classification guides for the specific FRD subject matter. 


(U) Additional Marking Instructions: 
= Applicable only to Top Secret and Secret FRD information. 
= SIGMA # currently represents one or more of the following numbers: 14, 15, 18, and 20. 
= Multiple SIGMA numbers must be listed numerically with a space preceding each value. 


(U) pelalonsmPts) to Other Markings: 
May only be used with TOP SECRET or SECRET. 
= Requires FRD as designated by joint DOE-DoD guidance. See FRD marking sections for additional marking 
guidance. 
= SIGMA 14, 15, 18, and 20 can only be used with TOP SECRET and SECRET FRD in accordance with DOE 
Order 452.8. 


(U) Precedence Rules for Banner Line Guidance: 
= — If the SIGMA marking is contained in any portion of a document, it must appear in the banner line. 
« If both RD and FRD SIGMA [#] portions are in a document, the RD-SIGMA [#] marking takes precedence 
over the FRD-SIGMA [#] marking in the banner line and all SIGMA numbers are listed in the banner line RD- 
SIGMA [#] marking, regardless of whether the information was RD or FRD. 
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(U) commingling Rule(s) Within a Portion: 

Where possible, SIGMA-marked information should be placed into a separate annex. If not possible, FRD- 
SG [#] must be indicated in the portion mark (unless RD is present, then RD appears in the portion mark). 

= Information marked FRD-SIGMA must not be commingled in the same portion with REL TO information 
unless an equivalent positive release determination has been made. Contact the Joint Atomic Energy 
Information Exchange Group (JAEIC OOE when a foreign disclosure/release determination is 
needed. 

= If both RD and FRD SIGMA [#] information are in the same portion, the RD-SIGMA [#] marking takes 
precedence over the FRD-SIGMA [#] marking in the portion mark and all SIGMA numbers are listed in the 
RD-SIGMA [#] marking in the portion mark, regardless of whether the information was RD or FRD. Note: It 
is not required but highly recommended that the RD and FRD SIGMA information is segregated into separate 
portions in a document so the FRD portion can be more readily shared within DoD and other government 
agencies. 


(U) Notes: ) 50 U.S.C. 30241 
= _FRD is not releasable to foreign nationals/governments unless authorized. Contact the JAEIG Ua 
hen a foreign disclosure/release determination is needed. 

= DOE manages the classification and declassification system for all FRD information and shares joint 

classification and declassification authority with DoD for all FRD information. 

= Automatic declassification of documents containing FRD information is prohibited. If a document contains 
both FRD information and NSI, the “Declassify On” line of the classification authority block must not include a 
declassification date or event, and must instead be annotated with “N/A to FRD portions. See source list for 
NSI portions.” 

= The NSI source list, as described in ISOO Implementing Directive, Section 2001.22(c), must include the 
declassification instruction for each of the source documents classified under EO 13526. 

= FRD information marked with obsolete SIGMAs (1-5 and 9-13) does not require review or re-marking while at 
rest (or when accessed). When information containing legacy SIGMAs is to be shared outside the originating 
agency, or if the information is to be incorporated, paraphrased, restated, or reintroduced into the working 
environment from a resting state, the obsolete SIGMAs must not be carried forward to any newly created 
information, rather they must be converted to the appropriate current SIGMA categories. Check with your 
organization's RD Management Official to determine how to convert the obsolete markings to the current 
SIGMA categories. 

= Most SIGMA 15 is RESTRICTED DATA-SIGMA15. A small portion has been transclassified to FORMERLY 
RESTRICTED DATA-SIGMA 15 by joint agreement of DoD and DOE. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): It may be extracted 
provided that: 
= The source document is portion marked. 
= It is recommended that any FRD portions be put in a separate attachment/appendix. 
= Contact the Joint Atomic Information Exchange Group (JAIEC) QQE kwhen a foreign 
disclosure/release determination is needed. 
= Automatic declassification of documents containing FRD-SIGMA information is prohibited. If a document 
contains both FRD-SIGMA information and NSI, the “Declassify On” line of the classification authority block 
must not include a declassification date or event, and must instead be annotated with “N/A to FRD portions. 
See source list for NSI portions." 


(U) Warnings and Notices: All documents containing FRD information (but no RD information) are required to 
include the following FRD warning statement on the first page: “(U) FORMERLY RESTRICTED DATA: 
Unauthorized disclosure is subject to administrative and criminal sanctions. Handle as RESTRICTED DATA 
in foreign dissemination. Section 144b, Atomic Energy Act of 1954.” 


(U) Some SIGMA categories require additional admonition blocks on the first page. Contact the National 


Nuclear Security Administration (JJC Kemet) for further guidance. 
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(U) Notional Example Page: 


SECRET//FORMERLY RESTRICTED DATA-SIGMA 14//NOFORN 


(S//FRD-SG 14//NF) This is the portion mark for a portion that is classified SECRET FORMERLY RESTRICTED 
DATA, SIGMA 14, and is not releasable to foreign nationals. This portion is marked for training purposes only. 


(S//NF) This is the portion mark for a portion of NSI that is classified SECRET and is not releasable to foreign 
nationals. This portion is marked for training purposes only. 


[Insert FRD Warning] 


(U) Note: Automatic declassification of documents containing FRD information is prohibited. If a document contains 
both FRD information and NSI, the “Declassify On” line of the classification authority block must not include a 
declassification date or event, and must instead be annotated with “N/A to FRD portions. See source list for NSI 
portions.” 


SECRET//FORMERLY RESTRICTED DATA-SIGMA 14//NOFORN 
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(U) Note: This marking will be evaluated for continued registration with the 14 November 2016 implementation of 
the Controlled Unclassified Information (CUI) Program. 


DOD UNCLASSIFIED CONTROLLED NUCLEAR 


(U) Authorized Banner Line Marking Title: INFORMATION 

(U) Authorized Banner Line Abbreviation: DOD UCNI 

(U) Authorized Portion Mark: DCNI 

(U) Example Banner Line: UNCLASSIFIED//DOD UCNI 

(U) Example Portion Mark: (U//DCNI) 

(U) Marking Sponsor/Policy Basis: DoD/Atomic Energy Act of 1954, as amended 


(U) Definitions: DOD UCNI is unclassified information on security measures for the physical protection of DoD 
Special Nuclear Material (SNM), equipment or facilities. Material is designated as DOD UCNI only when it is 
determined that its unauthorized disclosure could reasonably be expected to have a significant adverse effect on the 
health and safety of the public or the common defense and security by increasing significantly the likelinood of the 
illegal production of nuclear weapons or the theft, diversion or sabotage of DoD SNM, equipment or facilities. 


(U) Further Guidance: DoD 5210.83, dated July 12, 2012 
(U) Applicability: Agency specific. 
(U) Additional Marking Instructions: Applicable only to unclassified information. 


(U) Relationship(s) to Other Markings: 
= May only be used with UNCLASSIFIED. 
= The DOD UCNI marking must not be applied to classified matter that contains UCNI. 
= A classification authority block does not appear on a document that contains only portions of DOD UCNI. 


(U) Precedence Rules for Banner Line Guidance: 
= UNCLASSIFIED documents: DOD UCNI must always appear in the banner line. 
= Classified documents: DOD UCNI does not appear in the banner line; however, NOFORN must be applied if 
a less restrictive FD&R marking would otherwise be conveyed with the classified information. 


(U) Commingling Rule(s) Within a Portion: DOD UCNI may be commingled with classified non-UCNI material; in 
which case, the DCNI portion mark is not used because the classification level adequately protects the DOD UCNI 
information in the portion. Apply NF to the portion mark if a less restrictive FD&R marking would otherwise be used 
for the classified information. 


(U) Notes: Specific physical protection and access requirements apply; refer to DoD guidance. 
(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): 


= DOD UCNI information may be sourced in accordance with relevant policy and/or procedures. See above 
precedence and commingling rules. 
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= Foreign disclosure and release determinations require prior approval of the originating agency. Until 
originator approval is obtained, mark DOD UCNI portions as NOFORN when an FD&R marking is required as 
described in Section B.3., paragraph a., FD&R for IC Disseminated Analytic Products (DAPs) of this 
document. 


= Derivative classifiers that reuse DoD UCNI information in intelligence products must carry forward the DoD 
UCNI warning statement found on the face of the document. 


(U) Notional Example Page: 


UNCLASSIFIED//DOD UCNI 


(U//DCNI) This is the portion mark for an UNCLASSIFIED DOD CONTROLLED NUCLEAR INFORMATION 
portion. This portion is marked for training purposes only. 


(U) Note: A classification authority block does not appear on unclassified information. 


UNCLASSIFIED//DOD UCNI 
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(U) Note: This marking will be evaluated for continued registration with the 14 November 2016 implementation of 
the Controlled Unclassified Information (CUI) Program. 


(U) Authorized Banner Line Marking Title: DOE UNCLASSIFIED CONTROLLED NUCLEAR 


INFORMATION 
(U) Authorized Banner Line Abbreviation: DOE UCNI 
(U) Authorized Portion Mark: UCNI 
(U) Example Banner Line: UNCLASSIFIED//DOE UCNI 
(U) Example Portion Mark: (U//UCNI) 
(U) Marking Sponsor/Policy Basis: DOE/Atomic Energy Act of 1954, as amended, §148 


(U) Definitions: Applies to information that has been declassified or removed from the RD category but may not be 
disseminated to the general public. Included are certain unclassified aspects of design of the nuclear production and 
utilization facilities; security measures for production/utilization facilities, nuclear material contained in such facilities, 
and nuclear material in transit; as well as unclassified design, manufacture, and utilization information of any atomic 
weapon or component. 


(U) Further Guidance 
= 10 CFR 1017 
= DOE Order 471.1B, Identification and Protection of Unclassified Controlled Nuclear Information 


(U) Applicability: DOE. 


(U) Additional Marking Instructions: 
= Applicable only to unclassified information. 
= Handle as NOFORN when considering foreign disclosure and release, unless an affirmative decision has 
been made by the originating agency’s foreign disclosure and release authority. 


(U) Relationship(s) to Other Markings: 
= May only be used with UNCLASSIFIED. 
= The DOE UCNI marking must not be applied to classified matter that contains UCNI. 
= A classification authority block does not appear on a document that contains only portions of DOD UCNI. 


(U) Precedence Rules for Banner Line Guidance: 
= UNCLASSIFIED documents: DOE UCNI must always appear in the banner line. 
= Classified documents: DOE UCNI does not appear in the banner line; however, use NOFORN if a less 
restrictive FD&R marking would otherwise be conveyed with the classified information. 


(U) Commingling Rule(s) Within a Portion: DOE UCNI may be commingled with classified non-UCNI material; in 
this case, the DOE UCNI marking is not used because the classification level adequately protects the DOE UCNI 
information in the portion. Apply NF to the portion mark if a less restrictive FD&R marking would otherwise be used 
for the classified information 


118 
UNCLASSIFIED//rexs— 


320 


321 


UNCLASSIFIED//Fee— 


(U) Notes: Specific physical protection and access requirements apply. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): 

= DOE UCNI information may be sourced in accordance with DOE policy and procedures, and the above 
precedence and commingling rules. 

= — If an intelligence document or material marked as containing DOE UCNI (whether classified or not) falls under 
the cognizance of another DOE organization or other Government agency, the Reviewing Official or Denying 
Official must coordinate the decontrol review with that DOE organization or other Government agency. 

= Foreign disclosure and release requests must be coordinated with the cognizant DOE organization. Direct 
such requests to the DOE/IN Point of Entry, whose contact information can be found in the DNI/PE Directory 
for IC Senior Foreign Disclosure and Release Authorities. Until originator approval is obtained, mark DOE 
UCNI portions as NOFORN when an FD&R marking is required as described in Section B.3., paragraph a., 
FD&R for IC Disseminated Analytic Products (DAPs) of this document. 


(U) Notional Example Page: 


UNCLASSIFIED//DOE UCNI 


(U//UCNI) This is the portion mark for an UNCLASSIFIED DOE CONTROLLED NUCLEAR INFORMATION 
portion. This portion is marked for training purposes only. 


(U) Note: A classification authority block does not appear on unclassified information. 


UNCLASSIFIED//DOE UCNI 
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(U) Authorized Banner Line Marking 


Title: TRANSCLASSIFIED FOREIGN NUCLEAR INFORMATION 


(U) Authorized Banner Line Abbreviation: TFNI 


(U) Authorized Portion Mark: TFNI 

(U) Example Banner Line: SECRET//TFNI 

(U) Example Portion Mark: (S//TFNI) 

(U) Marking Sponsor/Policy Basis: rey aaa Energy Act Section 142e and 32CFR2001, 
.24(i 


(U) Definition: Information concerning the atomic energy programs of other nations that has been removed from the 
Restricted Data category for use by the Intelligence Community and is safeguarded as NSI under EO 13526. 


(U) Further Guidance: 
= EO 13526 
= [SOO Implementing Directive, 32CFR2001 
= ISOO Notice 2011-02 
= 10CFR1045 


(U) Applicability: DOE and DNI have joint responsibility for determining what information is TFNI. Intelligence agencies 
are authorized to derivatively classify and mark documents containing TFNI in accordance with the ISOO Implementing 
Directive, 32CFR2001, §2001.24(i), and additional instructions provided by DOE and ISOO (ISOO Notice 2011-02). Only 
authorized DOE personnel may remove TFNI markings from documents. 


(U) Additional Marking Instructions: 

= Applicable only to classified information. 

= |f TFNI appears in a portion marked document containing NSI, the “Declassify On” line of the classifier marking 
must be annotated with “N/A to TFNI portions. See source list for NSI Portions.” 

«Automatic declassification of documents containing TFNI information is prohibited. If a document contains both 
TFNI information and NSI, the “Declassify On” line of the classification authority block must not include a 
declassification date or event, and must be annotated instead with “N/A to TFNI portions. See source list for NSI 
portions.” 

= The NSI source list, as described in ISOO Implementing Directive, Section 2001.22(c), must include the 
declassification instruction for each of the source documents classified under EO 13526. 


(U) Relationship(s) to Other Markings: May only be used with TOP SECRET, SECRET, or CONFIDENTIAL. 


(U) Precedence Rules for Banner Line Guidance: 
= If the TFNI marking is contained in any portion of an NSI document, it must appear in the banner line. If the TFNI 
marking is contained in any portion of a document that contains portions of RD and/or FRD, the RD or FRD takes 
precedence. The “RD” or “FRD” marking, as appropriate, appears in the banner line and the "TFNI" marking does 
not appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: TFNI should not be commingled in the same portion to avoid competing 
classification and/or declassification equities. If TFNI is commingled with NSI within a portion, “TFNI” must be included in 
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the portion mark. If TFNI is commingled with RD or FRD within a portion, the RD or FRD takes precedence and “RD” or 
“FRD,” as appropriate, is annotated in the portion mark. 


(U) Notes: 
= DOE and DNI have joint responsibility for determining what information is TFNI. 
= The declassification of TFNI is determined by the Secretary of Energy. 
= Documents marked as containing TFNI are excluded from the automatic declassification provisions of EO 13526 
until the TFNI designation is properly removed by the Department of Energy. 
= TFNI may be shared with foreign partners in accordance with existing DNI and IC element guidance for foreign 
disclosure and release of classified NSI. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): TFNI information may be 
sourced provided that: 
= The source is portion marked. 
= The “Declassify On” line of the new document(s) must state “N/A to TFNI portions. See source list for NSI 
Portions.” as noted in the Additional Marking Instructions. 


(U) Warnings and Notices: None 


(U) Notional Example Page 1: 


SECRET//TFNI//NOFORN 


(S//TFNI//NF) This is the portion mark for a portion that is classified SECRET and containing TRANSCLASSIFIED 
FOREIGN NUCLEAR INFORMATION and not releasable to foreign nationals. This portion is marked for training 
purposes only. 


(U) Note: Automatic declassification of documents containing TFNI is prohibited. If a document contains only TFNI- 
marked portions, the “Declassify On:” line of the classification authority block must be annotated with “N/A to TFNI 
portions.” 


SECRET//TFNI//NOFORN 


(U) Notional Example Page 2: 


SECRET//TFNI//REL TO USA, ACGU 


(S//TFNI//REL TO USA, ACGU) This is the portion mark for a portion that is classified SECRET and contains 
TRANSCLASSIFIED FOREIGN NUCLEAR INFORMATION and authorized for release to ACGU (i.e., USA, 
Australia, Canada and United Kingdom). This portion is marked for training purposes only. 


(S//REL TO USA, ACGU) This is the portion mark for a portion that is classified SECRET and authorized for release 
to ACGU. This portion must contain only US classified information that is releasable to ACGU. This portion is 
marked for training purposes only. 


(U) Note: Automatic declassification of documents containing TFNI is prohibited. If a document contains both TFNI 


and NSI, the “Declassify On:” line of the classification authority block must be annotated with “N/A to TFNI portions. 
See source list for NSI Portions.” 


SECRET//TFNI//REL TO USA, ACGU 
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7. (U) Foreign Government Information Markings 


(U) Foreign Government Information (FGI) markings are used in US products to denote the presence of classified or 
unclassified foreign owned or produced information and the foreign source(s), if they may be acknowledged. These 
markings are used based on sharing agreements or arrangements with the source country or international organization. 


(U) The FGI markings included in the Register for banner lines are: 


= FGI [LIST] 
= FGI (when country[ies] or organization[s] of origin must be concealed) 


(U) The FGI markings included in the Register for portion marks are: 


=  /{{LIST] [Non-US Classification Portion Mark] or NATO [Classification Portion Mark]//[Special Access Program 
Marking(s)]//[Dissemination Controls] 
= //FGI [Non-US Classification Portion Mark] (when country[ies] or organization[s] of origin must be concealed) 


(U) FGI portion marks always start with a double forward slash (“//”). 


(U) “[LIST]’ pertains to one or more Register, Annex B trigraph country codes or Register, Annex A tetragraph code(s), or 
Manual, Appendix B NATO/NAC code(s) used with the FGI marking. Country trigraph codes are listed alphabetically 
followed by tetragraph codes in alphabetical order. Multiple FGI countries must be separated by a single space. 


(U) If a US document has portions with FGI markings that include SAP or dissemination control markings, roll-up the 
foreign control markings to the applicable marking category in the banner line after any US controls in that category. If 
multiple foreign controls are applicable, list them in ascending sort order with numbered values first, followed by 
alphabetic values. For example, a US classification banner line with FGI controls may appear as: 
SECRET//RD/ATOMAL//FGI NATO//NOFORN, where ATOMAL is a NATO Atomic Energy Act marking that follows the 
registered US Atomic Energy Act marking RD. 


(U) Any information from foreign governments that is disseminated or reused in the IC Information Technology Enterprise 
(IC ITE) must be marked in accordance with this section and Appendix A, Non-US Protective Markings. Any non- 
standard markings applied to US information to support foreign disclosure and release of the US information must be 
registered with the DNI by the applicable agency’s CMIWG representative. 


(U) Classified and unclassified FGI may include US foreign disclosure and release markings (i.e., NOFORN, REL TO, 
RELIDO, and DISPLAY ONLY) as circumstances warrant and in accordance with ICD 403 and applicable foreign 
disclosure and release processes and procedures. For additional guidance, refer to Section B.3., paragraphs c. and g. 
Explicit foreign release markings are not required on unclassified FGI. Follow internal agency procedures for the use of 
foreign disclosure and release markings with unclassified FGI. 


(U) Note: For more information about values, formats, and syntax of Non-US or NATO Markings, refer to the Non-US 
Protective Markings appendices of the Register and Manual. 
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(U) Authorized Banner Line Marking Title 
(when source is acknowledged): 


(U) Authorized Banner Line Marking Title 
(when source must be concealed): 


(U) Authorized Banner Line Abbreviation 
(when source is acknowledged): 


(U) Authorized Banner Line Abbreviation 
(when source must be concealed): 


(U) Authorized Portion Mark (when source(s) 
is acknowledged and segregated from US): 


(U) Authorized Portion Mark (when source 
must be concealed and segregated from US): 


(U) Example Banner Line of US document 
(when source is acknowledged) 


(U) Example Banner Line of US document 
(when source must be concealed) 


(U) Example Portion Mark (when source is 
acknowledged, segregated from US, and with 
multiple foreign sources): 


(U) Example Portion Mark (when sources are 
acknowledged, but not segregated from US): 


(U) Example Portion Mark (when source must 
be concealed and segregated from US): 


(U) Example Portion Mark (when source(s) 
must be concealed, but not segregated from 
US): 


(U) Marking Sponsor/Policy Basis: 


FOREIGN GOVERNMENT INFORMATION [LIST] 


FOREIGN GOVERNMENT INFORMATION 


FGI [LIST] 


FGI 


[LIST] [Non-US Classification Portion Mark] or NATO Portion 


Mark 


FGI [non-US Classification Portion Mark] 


TOP SECRET//FGI GBR 


TOP SECRET//FGI 


(/ICAN GBR S) 


(S//FGI AUS GBR) 


(//FGI TS) 


(TS//FGI) 


Respective country/EO 13526, §1.6(e) and §6.1(s) 


(U) Definition: Under EO 13526, Foreign Government Information is defined as: 
= Information provided to the United States Government by a foreign government or governments, an 
international organization of governments, or any element thereof, with the expectation that the information, 
the source of the information, or both, are to be held in confidence; 
= Information produced by the United States pursuant to or as a result of a joint arrangement with a foreign 
government or governments, or an international organization of governments or any element thereof, requiring 
that the information, the arrangement, or both, are to be held in confidence; or 
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Information received and treated as "Foreign Government Information" under the terms of a predecessor 
order. 


(U) Further Guidance: 


ISOO Implementing Directive, 32CFR2001, §2001.24(c), Foreign Government Information 
ISOO Implementing Directive, 32CFR2001, §2001.54, Foreign Government Information 
ISOO Implementing Directive, 32CFR2001, §2001.55, Foreign Disclosure of Classified Information 


(U) Applicability: Available for use by all IC elements as appropriate. 


(U) Saag eiscy Marking Instructions: 


Applicable to unclassified and classified foreign government information. 

Do not include country codes within the portion marks where the specific government(s) must be concealed. 
“[LIST]’ pertains to one or more Register, Annex B trigraph country codes or Register, Annex A tetragraph 
code(s), or Manual, Appendix B NATO/NAC markings used with the FGI marking. 

Multiple FGI countries must be listed alphabetically and separated by a single space. 

When the use of REL TO is appropriate to communicate a Non-US release determination, the “[USA, LIST]’ in 
the REL TO marking pertains to the string that contains “USA” followed by one or more Register, Annex B 
trigraph country code(s) or Register, Annex A tetragraph code(s), or Manual, Appendix B NATO/NAC 
markings used with the REL TO marking. “USA” must always appear first whenever the REL TO string is 
used to communicate release decisions either by the US or a Non-US entity. After USA, you must list one or 
more country trigraph codes in alphabetical order followed by tetragraph codes listed in alphabetical order. 
Each code is separated by a comma and a space. 

NOFORN may be used when release or disclosure back to the source country and any third-country is 
prohibited and must be approved by the responsible agency. 


(U) neravonenips) to Other Markings: 


May be used with TOP SECRET, SECRET, CONFIDENTIAL, RESTRICTED, UNCLASSIFIED, and other 
designators applied to sensitive information as identified in the Manual Appendix A, Enclosure 1 (e.g., Non- 
National Security Classification markings) applied by the non-US originator (unique markings may reveal 
source country). 


(U) Precedence Rules for Banner Line Guidance: 


Used as a content indicator to denote the presence of foreign government material in a US product. If any 
document contains portions of both source-concealed FGI, e.g., “(//FGI S//REL TO USA, GBR)” and source- 
acknowledged FGI, e.g., “(//GBR S//REL TO USA, GBR)”, then only the “FGI” marking without the source 
trigraph(s)/tetragraph(s) must appear in the banner line. 

Use FGI + Register, Annex B trigraph country code(s) and/or Register Annex A tetragraph code(s) in the 
banner line, unless the very fact that the information is foreign government information must be concealed. 
Then the FGI marking described here must not be used. Such information must be marked as if it were wholly 
of US origin. 


(U) commingling Rule(s) Within a Portion: 


Documents marked in accordance with ICD 206, Sourcing Requirements for Disseminated Analytic Products, 
dated 22 January 2015, may commingle FGI and US information in portions. The FGI must be identified in 
the source reference citations as endnotes in disseminated analytic products. 

Documents not marked in accordance with ICD 206 must segregate the FGI from US portions. 

Do not mix concealed FGI, e.g., “(//FGI S//REL TO USA, ACGUY with acknowledged FGI, e.g., “(//GBR 
S//NF)” within the same portion. 

Documents marked in accordance with ICD 206 may commingle FGI from more than one country and/or 
international organization in portions. Each FGI source must be identified in the source reference citations as 
endnotes in disseminated analytic products. 
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Documents not marked in accordance with ICD 206 must segregate the FGI from different sources in 
separate portions. 


(U) Notes: 


Release or disclosure of FGI back to the source country is prohibited and must be approved by the 
responsible agency if the source country is not repeated in the foreign release marking(s) or is marked with 
NOFORN. 

The release or disclosure of FGI to any third-country entity must have the prior consent of the originating 
government if required by a treaty, agreement, bilateral exchange, or other obligation (see ISOO 
Implementing Directive §2001.54[e]). 

Unclassified FGI is withheld from public release until approved for release by the source country. 

FGI may have dissemination control markings used to communicate the expansion or limitation on the 
distribution of the information. For translation purposes, Non-US dissemination control markings that are not 
the same as a US control marking are placed in the US Non-IC Dissemination Control Markings category in 
both portion marks and banner lines as follows: 

e Unique dissemination controls that are not the same as a US control marking follow any US 
dissemination control(s) in the Non-IC Dissemination Control Markings category. If multiple controls 
are applicable, list them in ascending sort order with numbered values first, followed by alphabetic 
values. 

e FGI dissemination controls that are the same as a US control marking are placed in the US 
dissemination control marking location (e.g., ORCON). 

FGI ORCON information derivatively sourced in a US product is subject to the controls of US ORCON 
information as prescribed in ICPG 710.1. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): FGI information may 
be sourced in accordance with the relevant foreign sharing agreement(s)/arrangement(s). See above precedence and 
commingling rules and Section B.3., paragraphs c. and g. For guidance on the derivative use of NATO information in a 
US product, please see Appendix B- NATO Protective Markings. 
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(U) Notional Example Page 1: 


TOP SECRET//FGI CAN DEU//REL TO USA, CAN, DEU 


(TS//REL TO USA, CAN, DEU) This is the portion mark for a US portion classified TOP SECRET and authorized 
for release to Canada (CAN) and Germany (DEU). This portion must contain only US classified information that 
is releasable to CAN and DEU. This portion is marked for training purposes only. 


(TS//FGI DEU//REL TO USA, CAN, DEU) This is the portion mark for a commingled portion of US TOP SECRET 
information and DEU SECRET information, in which Germany has authorized release back to DEU and further 
release to USA and Canada (CAN). This document must include source reference citations as endnotes for the 
DEU information as required by ICD 206. This portion is marked for training purposes only. 


(/ICAN S//REL TO USA, CAN, DEU) This is the portion mark for a Canadian (CAN) SECRET portion within a US 
classified document, in which Canada has authorized release back to CAN and further release to USA and DEU. 
This portion must contain only CAN SECRET FGI that is releasable to the countries listed. This portion is marked 
for training purposes only. 


(U) Note: Release or disclosure of FGI back to the source country is prohibited and must be approved by the 
responsible agency if the source country is not repeated in the foreign release marking(s) or is marked NOFORN. 
The release or disclosure of FGI to any third-country entity must have the prior consent of the originating 
government if required by a treaty, agreement, bilateral exchange, or other obligation (see ISOO Directive No. 1 
2001.53[e]). 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//FGI CAN DEU//REL TO USA, CAN, DEU 
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(U) Notional Example Page 2: 


TOP SECRET//BOHEMIA//FGI AUS CAN DEU NATO//NOFORN 
(U) [Insert NATO warning statement 


(TS//RELIDO) This is the portion mark for a portion that is classified US TOP SECRET and the originator has 
explicitly deferred the foreign disclosure and release determination toa SFDRA. This portion must contain only 
US classified information. This portion is marked for training purposes only. 


(//CAN DEU S//REL TO USA, CAN, DEU) This is the portion mark for a commingled portion of Canadian (CAN) 
and German (DEU) SECRET within a US classified document in which Canada and Germany have authorized 
release back to CAN and DEU and further release to USA. This portion must contain only CAN and DEU 
SECRET FGI that is releasable to the countries listed. This document must include source reference citations as 
endnotes for the CAN and DEU information as required by ICD 206. Use Register, C trigraph country codes or 
Register, Annex A tetragraph code(s). This portion is marked for training purposes only. 


(MAUS S//REL TO USA, AUS) This is the portion mark for an Australian SECRET portion within a US classified 
document, in which Australia (AUS) has authorized release back to Australia and further release to USA. This 
portion must contain only Australian SECRET FGI. Use Register, Annex B trigraph country codes or Register, 
Annex A tetragraph code(s). This portion is marked for training purposes only. 


(//CTS//BOHEMIA//REL TO USA, NATO) This is the portion mark fora NATO COSMIC TOP SECRET (CTS) 
BOHEMIA portion within a US classified document and is releasable back to NATO. This portion must contain 
only NATO COSMIC TOP SECRET BOHEMIA FGI. This portion is marked for training purposes only. 


(U) Note: Documents containing multiple portions with different disclosure or release markings must be marked 
overall with the most protective marking. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//BOHEMIA//FGI AUS CAN DEU NATO//NOFORN 
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(U) Notional Example Page 3: 


SECRET//FGI//NOFORN 


(S//RELIDO) This is the portion mark for a portion that is classified US SECRET and the originator has explicitly 
deferred the foreign disclosure and release determination to a SFDRA. This portion must contain only US 
classified information. This portion is marked for training purposes only. 


(//DEU S//NF) This is the portion mark for a portion that is classified German (DEU) SECRET and is not 
releasable back to Germany or to any third country entity. Because this document is not marked in accordance 
with ICD 206 (i.e., it is not a disseminated analytic product), this portion must contain only DEU SECRET FGI. 
This portion is marked for training purposes only. 


(//DEU C//REL TO USA, CAN, DEU) This is the portion mark for a German (DEU) CONFIDENTIAL portion within 
a US classified document, in which Germany has authorized release back to Germany and further release to 
USA and Canada (CAN). Because this document is not marked in accordance with ICD 206 (i.e., it is not a 
disseminated analytic product) this portion must contain only DEU CONFIDENTIAL FGI that is releasable to the 
countries listed. This portion is marked for training purposes only. 


(//FGI S//NF) This is the portion mark for a portion that is classified SECRET unacknowledged FGI within a US 
classified document and is not releasable back to the originating country or to any third country entity. Because 
this document is not marked in accordance with ICD 206 (i.e., it is not a disseminated analytic product) this 
portion must contain only SECRET FGI. This portion is marked for training purposes only. 


(U) Note: Release or disclosure of FGI back to the source country is prohibited and must be approved by the 
responsible agency if the source country is not repeated in the foreign release marking(s) or is marked with 
NOFORN. 


(U) Note: The release or disclosure of FGI to any third-country entity must have the prior consent of the 
originating government if required by a treaty, agreement, bilateral exchange, or other obligation (ISOO Directive 
No. 1 2001.53[e]). 


(U) Note: Per ICD 710, §G, documents containing multiple portions with different disclosure or release markings 
must be marked overall with the most protective marking. A document containing portions of both source- 
concealed FGI and source-acknowledged FGI must have only the “FGI” marking without source 
trigraph(s)/tetragraph(s) in the banner line, as it is the most restrictive form of the marking. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//FGI//NOFORN 
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(U) Notional Example Page 4: 


TOP SECRET//FGI CAN DEU//NOFORN 


(S//REL TO USA, AUS) This is the portion mark for a US SECRET portion and is authorized for release to 
Australia (AUS). This portion must contain only US classified information that is releasable to Australia. This 
portion is marked for training purposes only. 


(//CAN S//REL TO USA, AUS, CAN, GBR) This is the portion mark for a Canadian (CAN) SECRET portion in 
which Canada has authorized release back to CAN and further release to USA, Australia (AUS), and United 
Kingdom (GBR) within a US classified document. Because this document is not marked in accordance with ICD 
206 (i.e., it is not a disseminated analytic product) this portion must contain only Canadian SECRET releasable 
FGI to the countries listed. Use Register, Annex B trigraph country codes or Register, Annex A tetragraph 
code(s). This portion is marked for training purposes only. 


(//DEU TS//NF) This is the portion mark for a German (DEU) TOP SECRET portion within a US classified 
document that Germany has determined is not releasable back to DEU or to any third country entity. Because 
this document is not marked in accordance with ICD 206 (i.e., it is not a disseminated analytic product) this 
portion must contain only German TOP SECRET FGI. Use Register, Annex B trigraph country codes or Register, 
Annex A tetragraph code(s). This portion is marked for training purposes only. 


(U) Note: Release or disclosure of FGI back to the source country is prohibited and must be approved by the 
responsible agency if the source country is not repeated in the foreign release marking(s) or is marked with 
NOFORN. 


(U) Note: Per ICD 710, §G, documents containing multiple portions with different disclosure or release markings 
must be marked overall with the most protective marking. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//FGI CAN DEU//NOFORN 
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(U) Notional Example Page 5: 


SECRET//FGI CAN GBR//REL TO USA, CAN, GBR 


(S//FGI CAN//REL TO USA, CAN, GBR) This is the portion mark for a commingled US and Canadian (CAN) 
SECRET portion that is authorized for release back to CAN and release to USA and United Kingdom (GBR) 
within a US classified document. This document must include source reference citations as endnotes for the CAN 
information as required by ICD 206. This portion is marked for training purposes only. 


(//GBR S//REL TO USA, CAN, GBR) This is the portion mark fora GBR SECRET portion in which United 
Kingdom has authorized release back to GBR and further release to USA and CAN within a US classified 
document. This portion must contain only United Kingdom SECRET FGI releasable to the countries in the REL 
TO list. Use Register, Annex B trigraph country codes or Register, Annex A tetragraph code(s). This portion is 
marked for training purposes only. 


(U) Note: REL TO with an overlap in the country lists, roll-up to the most restrictive list. Canada and United 
Kingdom appear in the banner line because these countries appear in all portions. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//FGI CAN GBR//REL TO USA, CAN, GBR 
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8. (U) Dissemination Control Markings 


(U) General Information 


(U) Dissemination Controls are control markings that identify the expansion or limitation on the distribution of information. 
These markings are in addition to and separate from the levels of classification defined by EO 13526. 


(U) The Information Security Oversight (ISOO) Implementing Directive (32CFR2001, §2001.24{j][2]), identifies the DNI as 
the authority over external dissemination control and handling markings for intelligence and intelligence-related 
information. Only those DNlI-authorized external dissemination control and handling markings contained in the Register 
may be used by IC elements to control and handle external dissemination of classified information. 


(U) Multiple entries may be chosen from the Dissemination Control Markings category. If multiple entries are used, list 
them in the order in which they appear in the Register. Use a single forward slash with no interjected space as the 
separator between multiple dissemination control markings. 


(U) Note: Some dissemination controls are restricted to use by certain Agencies. They are included in the Register to 
provide guidance on handling documents that bear them. Their inclusion in the Register does not authorize other 
agencies to originate these markings. 


(U) The following dissemination control markings and their respective sponsor(s) are listed below in the order they appear 
in the Register. 


= RISK SENSITIVE (NGA) 


= FOR OFFICIAL USE ONLY (Various Agencies) 

= ORIGINATOR CONTROLLED (DNI) 

= ORIGINATOR CONTROLLED-USGOV (DNI) 

= CONTROLLED IMAGERY (DNI) 

= NOT RELEASABLE TO FOREIGN NATIONALS (DNI) 

= CAUTION-PROPRIETARY INFORMATION INVOLVED (DNI) 

= AUTHORIZED FOR RELEASE TO [USA, LIST] (DNI) 

= RELEASABLE BY INFORMATION DISCLOSURE OFFICIAL (DNI) 

= USA/[country trigraphs] EYES ONLY (NSA) Note: NSA has been granted a control markings waiver through 9 
September 2016, at which time it will expire automatically. Automated systems will be modified to reject 
information marked EYES ONLY beginning 01 October 2017. 

= DEA SENSITIVE (DEA) 

= FOREIGN INTELLIGENCE SURVEILLANCE ACT (DNI) 


= DISPLAY ONLY [LIST] (DNI) 
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(U) Authorized Banner Line Marking Title: RISK SENSITIVE 

(U) Authorized Banner Line Abbreviation: RSEN 

(U) Authorized Portion Mark: RS 

(U) Example Banner Line: TOP SECRET//TK//RSEN 
(U) Example Portion Mark: (TS//TK//RS) 


(U) Marking Sponsor/Policy Basis: NGA/National System for GEOINT (NSG) 


(U) Definition: This term is used to protect especially sensitive imaging capabilities and exploitation techniques. 


(U) Further Guidance: 
= NGA, Geospatial Intelligence (GEOINT) Security Classification Guide (SCG) Annex: (U) Sensitive Analytical 
Techniques (SAT) 
= NSGM documentation when TK and RSEN are used together 
= Talent Keyhole Control System Manual 
= NSG GEOINT Security Classification Guide 


(U) Applicability: Available for use by all agencies. 


(U) Additional Marking Instructions: 
= Applicable only to Top Secret or Secret information. 
=" See Warnings and Notices below for important guidance regarding use of SAT information. 


(U) Relationship(s) to Other Markings: 
= May only be used with TOP SECRET or SECRET. 
= May be used with TK. 


(U) Precedence Rules for Banner Line Guidance: If any portion contains RISK SENSITIVE information, the RSEN 
marking must appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate and the RS 
marking must be conveyed in the portion mark. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): RSEN information 
may be sourced in accordance with relevant IC policy and/or procedures. See above precedence and commingling 
rules. 


(U) Warnings and Notices 

(U/EQULO. Some TS//TK/RSEN information has been designated by the Sensitive Analytical Techniques Panel for 
special protection. When SATs are used in documents or graphics, it is necessary to use the appropriate warning 
statement. Warnings shall be placed at the top of a document and left justified. 
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= For TS//TK//RSEN SAT information: 
e “(U//FOUO) Warning: This document contains references to Sensitive Analytical Techniques 
(Sensitive TK Imagery Information)” 
= For TS//TK//RSEN SAT combined with IMCON//REL TO USA, FVEY information: 
e "(U//FOUO) Warning: This document contains references to Sensitive Analytical Techniques 
(Sensitive TK Imagery Information and IMCON Information). Further reuse or dissemination 
of this information beyond USA, AUS, CAN, GBR, or NZL requires written approval of 


NGA Foreign Disclosure Officer. Contact the SAT Panel Executive Officer for queries 
(b)(3) 10 U.S.C. 424 IMCON information is not permitted on the SECRET network 
(i.e., SIPRNET) without prior written approval by the SATP Chair." 
= For TS//TK//RSEN SAT combined with NOFORN/IMCON information: 

e "(U//FOUO) NOTICE: This document contains references to Sensitive Analytical Techniques 
(Sensitive TK Imagery Information and IMCON Information). Further reuse or dissemination 
of this information beyond USA requires written approval of the NGA Foreign Disclosure 
Officer. Contact the SAT Panel Executive Officer for queries IOMO: 
ECON information is not permitted on the SECRET network (i.e., SIPRNET) without 
prior written approval by the SATP Chair." 


(U) Notional Example Page: 


TOP SECRET//TK//RSEN/REL TO USA, ACGU 


(TS//TK//RS/REL TO USA, ACGU) This is the portion mark for a portion that is classified TOP SECRET, contains 
TALENT KEYHOLE information, is handled as RISK SENSITIVE, and is authorized for release to ACGU (i.e., 
USA, Australia, Canada and United Kingdom). This portion must contain only US classified information that is 
releasable to ACGU. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//TK//RSEN/REL TO USA, ACGU 
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(U) Note: This marking will be evaluated for continued registration with the 14 November 2016 implementation of 
the Controlled Unclassified Information (CUI) Program. 


(U) Authorized Banner Line Marking Title: FOR OFFICIAL USE ONLY 
(U) Authorized Banner Line Abbreviation: FOUO 

(U) Authorized Portion Mark: FOUO 

(U) Example Banner Line: UNCLASSIFIED//FOUO 
(U) Example Portion Mark: (U//FOUO) 

(U) Marking Sponsor/Policy Basis: Various Agencies 


(U) Definition: Intelligence marking used for UNCLASSIFIED official government information that is withheld from 
public release until approved for release by the originator. 


(U) Further Guidance: Agency specific. 
(U) Applicability: Available for use by all agencies. 


(U) Additional Marking Instructions: Applicable only to unclassified information. 


(U) Relationship(s) to Other Markings: 
= May only be used with UNCLASSIFIED. 
= Documents that are UNCLASSIFIED//FOR OFFICIAL USE ONLY or UNCLASSIFIED//FOUO must be portion 
marked. 


(U) Precedence Rules for Banner Line Guidance: 
= FOQUO in a classified document: 

e When aclassified document contains portions of FOUO information, the FOUO marking is not used in the 
banner line. 

e Portions of a classified document that are FOUO must be portion marked “(U//FOUO)”. 

= FQUO in an unclassified document: 

e FOUO must convey in the banner line if the document is UNCLASSIFIED with FOUO marked information 
and no other dissemination control markings. 

e FOUO must convey in the banner line if the document is UNCLASSIFIED with only FOUO and FD&R 
markings. The appropriate FD&R markings must also convey in the banner line based on existing banner 
line roll-up rules for FD&R markings. 

e  FOUO is not conveyed in the banner line if the document is UNCLASSIFIED with FOUO and other 
dissemination control markings, excluding any FD&R markings. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate and the 
FOUO marking only conveys in the portion mark based on the rules provided above for banner line precedence. 
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(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): FOUO information 


may be sourced in accordance with relevant policy and/or procedures. See above precedence and commingling 
rules. 


(U) Notional Example Page: 


UNCLASSIFIED//FOR OFFICIAL USE ONLY 


(U//FOUO) This is the portion mark for an UNCLASSIFIED FOR OFFICIAL USE ONLY portion. This portion is 
marked for training purposes only. 


UNCLASSIFIED//FOR OFFICIAL USE ONLY 
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(U) Authorized Banner Line Marking Title: ORIGINATOR CONTROLLED 

(U) Authorized Banner Line Abbreviation: ORCON 

(U) Portion Mark: OC 

(U) Example Banner Line: TOP SECRET//ORCON 

(U) Example Portion Mark: (S//OC) 

(U) Marking Sponsor/Policy Basis: DNI/National Security Act of 1947, §103 (c)(5) 


(U) Definition: The ORCON marking may be applied by originators of classified national intelligence information that 
meets one or more of the criteria listed in section §D.3 of Intelligence Community Policy Guidance (ICPG) 710.1, 
Application of Dissemination Controls: Originator Control. This marking allows originators to maintain knowledge, 
supervision, and control of the distribution of the ORCON information beyond its original dissemination. Further 
dissemination of ORCON information requires advance permission from the originator. 


(U) Note: Use the ORCON-USGOV marking rather than ORCON when ORCON information is pre-approved by the 
originator for dissemination to Executive Branch departments and agencies and for use in disseminated analytic 
products for congressional intelligence committees that have oversight functions and responsibilities. (See the 
ORCON-USGOV template for additional guidance.) 


(U) Further Guidance: 
= Principal Deputy Director of National Intelligence Memo, E/S 00124, dated 14 February 2008 
= ICD 710 
= ICPG 710.1 


(U) Applicability: Available for use by all IC agencies as appropriate. 


(U) Additional Marking Instructions: 
= Applicable only to classified information. 
= For DAPs, originators must ensure each product includes a human and machine readable originator and 
dissemination list per ICPG 710.1 §E.4.b. 


(U) Relationship(s) to Other Markings: 
= May only be used with TOP SECRET, SECRET, or CONFIDENTIAL. 
= May not be used with ORCON-USGOV in a portion mark or banner line. 
= May be used with NOFORN, REL TO, DISPLAY ONLY. 
= May not be used with RELIDO. 


(U) Precedence Rules for Banner Line Guidance: 
= The ORCON marking must always appear in the banner line if any portion contains ORCON information. 
= If ORCON and ORCON-USGOV portions are in a document, ORCON takes precedence and is conveyed in 
the banner line. 
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(U) commingling Rule(s) Within a Portion: 


May be combined with other classified, non-ORCON information when appropriate (e.g., SCI, SAP, AEA, FGI, 
IC and Non-IC dissemination controls) and the OC marking is conveyed in the portion mark. 

If combined with non-ORCON information in a single portion, the non-ORCON information must also be 
handled in a manner consistent with ORCON information as provided in ICPG 710.1 (see first Note below). 
Originating agencies are responsible for determining and providing guidance to classifiers as to when it is 
appropriate to commingle ORCON information in the same portion with other information that has SCI/SAP, 
AEA, FGI, or IC and Non-IC dissemination control markings. 

If ORCON and REL TO are used in a portion marking, the originating IC element is explicitly indicating a 
positive release decision to the foreign recipients on original distribution. Recipients must obtain originator 
approval prior to further dissemination beyond the original distribution list. 

May be combined with ORCON-USGOV information in the same portion; the OC marking takes precedence 
and is conveyed in the portion mark. 


(U) Notes: 


Originators of ORCON information must separate sources, methods, and activities content from the 
substantive classified national intelligence by using tearlines, write for release, or other sanitization methods 
in accordance with DNI policy. 

ORCON information may be shared with all recipients who have been authorized to receive the information 
on the dissemination list (either the original dissemination list or an originator-authorized amendment to the 
dissemination list) or by pre-approval, to include dissemination to congressional committees consistent with 
oversight functions and requirements. 

Recipients of ORCON information may further share the information without additional approval from the 
originator to organizations and individuals described in ICPG 710.1, §E.1.b., and in accordance with 
requirements for access to classified NSI set forth in EO 13526, §4.1(a). 

Requests for further sharing of ORCON information beyond the organizations and individuals described in 
ICPG 710.1, §E.1., to include recipients outside the IC, require advance permission of the originator. 


(U) peuaye Use (i.e., re-use of information in whole or in part in intelligence products): 


The use of ORCON enables the originator to maintain knowledge, supervision, and control of the distribution 
of ORCON information beyond its original dissemination. Further dissemination of ORCON information 
requires advance permission from the originator, who must make a determination based on the mission need 
of the intended recipient. 

o Information marked with ORCON may be incorporated in whole or in part into other briefings or 
products, provided the briefing or product is presented or distributed only to original recipients of the 
information and those organizations and individuals described in ICPG 710.1, §E.1.b. 

As described in ICPG 710.1 §E.3.a, the Principal Deputy DNI (PDDNI), in consultation with the heads of IC 
elements, must designate Secure Communities Of Interest (SCOl) within which relevant disseminated 
ORCON information originated by an IC element may be posted by any authorized recipient participating in 
the SCOI without additional originator approvals or control. SCOI participants are not authorized to share 
ORCON material outside the SCOI with any organization that is not otherwise an authorized recipient without 
pre-approval by the originator and in accordance with the procedures in ICPG 710.1, §E.4.a. 


(U) Warnings and Notices: Certain types of ORCON information may require the addition of a distribution or warning 
statement. When this occurs, the required distribution or warning statement should not repeat or re-state the ORCON 
restrictions, but rather provide the necessary additional direction. 
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(U) Notional Example Page: 


TOP SECRET//ORCON/NOFORN 


(TS//OC/NF) This is the portion mark for a portion of information that is classified TOP SECRET, ORIGINATOR 
CONTROLLED, and is not releasable to foreign nationals. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//ORCON/NOFORN 
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(U) Authorized Banner Line Marking Title: ORIGINATOR CONTROLLED-USGOV 

(U) Authorized Banner Line Abbreviation: ORCON-USGOV 

(U) Authorized Portion Mark: OC-USGOV 

(U) Example Banner Line: SECRET//ORCON-USGOV 

(U) Example Portion Mark: (S//OC-USGOV) 

(U) Marking Sponsor/Policy Basis: DNI National Security Act of 1947, as amended 


(U) Definition (Description): The ORCON-USGOV marking is used by IC elements that originate ORCON 
information to communicate to recipients that the information has been pre-approved for further dissemination without 
originator approval to the US Government’s Executive Branch Departments and Agencies. It is also approved for use 
in disseminated analytic products (i.e., not unevaluated or raw intelligence) and other products or information, as 
determined by the originating agency in consultation with their Office of Legislative Affairs (OLA), provided to 
congressional Intelligence Committees that have oversight functions and responsibilities. ORCON appears in the 
label to ensure recipients are aware of and adhere to the processes, procedures, access and reporting requirements 
as set forth in EO 13526, Section 4.1 and ICPG 710.1. Dissemination to other US entities requires originator 
approval. Originators of ORCON-USGOV must also adhere to the marking criteria and reporting requirements for 
ORCON information when applying the ORCON-USGOV marking as established in ICPG 710.1. 


(U) When applied, the ORCON-USGOV marking does not alter the definition, processes, procedures, or pre-approval 
agreements associated with the ORCON marking. This marking will prevent the proliferation of non-standard 
markings, and distribution and warning statements. It is also communicates pre-approval for dissemination to 
Executive Branch agencies/departments and dissemination of analytic products to congressional Intelligence 
Committees. Other distribution and warning statements used to communicate other ORCON pre-approval 
agreements remain valid and must be applied as appropriate. 


(U) Note: USG Executive Branch Departments and Agencies must contact their OLA for guidance in determining the 
appropriate Congressional Intelligence Committee recipient(s). 


(U) Further Guidance (cite additional issuances): 


= EO 13526 
= ICD 710 
=  ICPG 710.1 


(U) Applicability: Available for use by all IC agencies. 


(U) Additional Marking Instructions: 
= Applies only to classified information. 
= For DAPs, originators must ensure each product includes a human and machine readable originator and 
dissemination list per ICPG 710.1 §E.4.b. 


(U) Relationship(s) to Other Markings: 
= May only be used with TOP SECRET, SECRET, CONFIDENTIAL. 
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May not be used with ORCON in a portion mark or banner line. 

May be used with NOFORN, REL TO, DISPLAY ONLY. 

May not be used with RELIDO. 

May not be used with SI-G or SI-G sub-compartments. 

May not be used with HCS-O. May be used with HCS-P; may not be used with HCS-P sub-compartments. 


(U) Precedence Rules for Banner Line Guidance: When a document contains both ORCON-USGOV portions and 
ORCON portions, ORCON takes precedence within the banner line. 


(U) Commingiing Rule(s) Within a Portion: 


May be commingled within the same portion with SCI/SAP, AEA, FGI, and other dissemination controls to 
include foreign disclosure and release markings, if the commingled information meets one or more of the 
ORCON use criteria as described in ICPG 710.1 paragraph D.3 and is pre-approved for dissemination to the 
USGOV. (USGOV is defined as the Executive Departments/Agencies and to Congressional Intelligence 
Committee(s) with oversight functions and responsibilities.) 

Originating agencies are responsible for determining and providing guidance to classifiers regarding 
commingling ORCON-USGOV information in the same portion with other information that has SCI/SAP, AEA, 
FGI or other IC and Non-IC dissemination control markings. 

If ORCON-USGOV and REL TO are used in a portion marking, the originating IC element is explicitly 
indicating a positive release decision to the foreign recipients on original distribution. Recipients must obtain 
originator approval prior to further dissemination beyond the original distribution list. 

If a portion contains both ORCON and ORCON-USGOV information, ORCON takes precedence in the portion 
mark. 

All roll-up rules for control markings used in conjunction with the ORCON-USGOV marking remain applicable. 
See specific templates for additional roll-up guidance. 


(U) Notes: 


Information marked ORCON-USGOV may be shared on IC SCOls in accordance with ICPG 710.1. 
Information bearing the ORCON-USGOV marking may be stored, transmitted, posted or retrieved from 
classified electronic systems, databases, repositories, networks, or web pages in IC secure collaborative 
environments that have the ability to limit access to users who are employed by, assigned to, or acting on 
behalf of an Executive Branch department/agency. 

Disseminated analytic products bearing the marking may be stored, transmitted, posted, or retrieved from 
classified electronic systems, databases, repositories, networks, or web pages in secure collaborative 
environments by Congressional Intelligence Committee(s) that have oversight functions and responsibilities 
(recipients must consult with their legislative affairs offices on guidance to determine appropriate oversight 
committees). 

Information marked ORCON-USGOV may not reside in or be transmitted over unclassified systems or 
unclassified sharing environments of any kind. 

Legacy information (e.g., portions extracted, reintroduced into the working environment from a resting state): 
The ORCON-USGOV marking may be authorized for use on legacy ORCON information only by originators, 
as appropriate. Contact the originating agency for guidance. 

The ORCON-USGOV marking does not replace any legacy marking; however, it provides an alternative to the 
legacy practice of applying ORCON with a preapproval notice that replicates the ORCON-USGOV pre- 
approvals. 


(U) Derivative Use: (i.e., re-use of information in whole or in part in other intelligence products): Information 
bearing this marking may be extracted and used in other disseminated analytic products, provided they are presented 
or distributed only to original and pre-approved recipients of Executive Branch departments/agencies or 


Congressional Intelligence Committees. A producer must receive approval from the originating agency prior to 
disseminating it to other organizations outside the Executive Branch or Congressional Intelligence Committees. 
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(U) Warnings and Notices: There may be certain types of ORCON-USGOV information that require a distribution or 
warning statement in addition to the marking. When this occurs, the required distribution or warning statement should 
not re-state what the marking means, but rather provide additional direction. 


(U) Notional Example Page 1: 


TOP SECRET//ORCON-USGOV/NOFORN 


(TS//OC-USGOV/NF) This is the portion mark for a portion that is classified TOP SECRET, is controlled as 
ORCON-USGOV information, and is not authorized for release to foreign nationals. These markings are for training 
purposes only. 


(C//NF) This is the portion mark for a portion that is classified CONFIDENTIAL and is not authorized for release to 
foreign nationals. These marking are for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//ORCON-USGOV/NOFORN 


(U) Notional Example Page 2: 


TOP SECRET//ORCON/NOFORN 


(TS//OC-USGOV/NF) This is the portion mark for a portion that is classified TOP SECRET, is controlled as 
ORCON-USGOV information, and is not authorized for release to foreign nationals. These markings are for 
training purposes only. 


(S//OC/NF) This is the portion mark for a portion that is classified SECRET, is controlled as ORCON information, 
and is not authorized for release to foreign nationals. These markings are for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//ORCON/NOFORN 
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(U) Authorized Banner Line Marking Title: CONTROLLED IMAGERY 

(U) Authorized Banner Line Abbreviation: IMCON 

(U) Authorized Portion Mark: IMC 

(U) Example Banner Line: SECRET//CONTROLLED IMAGERY 

(U) Example Portion Mark: (S//IMC) 

(U) Marking Sponsor/Policy Basis: DNI/National Security Act of 1947, §103 (c)(5) 


(U/F@¥ Definition: Controlled Imagery or IMCON is applied to SECRET-level Sensitive Analytical Techniques 
(SATs) that have been approved by the Sensitive Analytical Techniques Panel (SATP). SATs are sensitive imagery 
signatures that can be classified, with prior SATP approval, at either the SECRET//IMCON or TOP 
SECRET//TK//RSEN level. (])0IURSKemEIZ 


(U) Further Guidance: 
= NGA, Geospatial Intelligence (GEOINT) Security Classification Guide (SCG) Annex: (U) Sensitive Analytical 
Techniques (SAT) 


(U) Applicability: Available for use by all IC agencies. 


(U) Additional Marking Instructions: 
= Applicable only to TOP SECRET and SECRET information. 
«» IMCON Information without NOFORN may be released to AUS, CAN, GBR, and NZL without receiving prior 
approval from the originating agency; when appropriate, the REL TO marking is used to communicate this 
explicit release determination (i.e., S/IMC/REL TO USA, AUS, CAN, GBR, NZL). 


(U) Relationship(s) to Other Markings: 
= May only be used with TOP SECRET or SECRET — see precedence and commingling rules. 
= May be used with REL TO or NOFORN when appropriate; release of NOFORN requires approval by the 
SATP. 


(U) Precedence Rules for Banner Line Guidance: 
= IMCON must always appear in the banner line if any portion contains IMCON information. 
= A document that contains both IMCON and NOFORN portions must be marked [class 
level]//IMCON/NOFORN in the banner line. 


(U) Commingling Rule(s) Within a Portion: If IMCON information is included in a portion containing additional TOP 
SECRET releasable to Five Eyes information, the paragraph would be marked as (TS//IMC/REL TO USA, AUS, 
CAN, GBR, NZL). The overall classification level would be TOP SECRET//IMCON/[Explicit FD&R]. 


(U) Notes: 
= IMCON information is not releasable to third parties without specific approval from the originating agency 
and the SATP. 
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Information bearing (S//IMC/REL TO USA, AUS, CAN, GBR, NZL) at the beginning of a paragraph may be 
disseminated to those countries without receiving prior approval from the originating agency. Dissemination 
to other entities is prohibited without the prior written approval of the originating agency and the SATP. 
This information may be used freely in Community and Command databases and may be disseminated to 
US military units and Intelligence Community agencies. However, products containing IMCON information 


are not permitted on SECRET networks (SIPRNet) without prior written approval by the SATP Executive 
(6)(3) 10 U.S.C. 424 


Officer, 


(U) Warnings and Notices: 
(U) Although the legacy DCID 6/6 indicated that the IMCON notice was not required beyond 1 April 2002, the 


Imagery Policy and Security Committee (IPSCOM) approved its continued use indefinitely. For additional 
information on releasability and NOFORN issues, please contact the SATP Chair (OO) 10 U.S.C. 424 
aaa 


(U) Imagery and/or text reporting bearing the IMCON restriction requires one of the following notices, which 
shall be placed at the top of the document and left justified: 


= For REL FVEY: 


(U//FEvS> NOTICE: This document contains references to Sensitive Analytical Techniques (IMCON 
Information). Further reuse or dissemination of this information beyond USA, AUS, CAN, GBR, or 


NZL requires written approval of the SATP. Contact the SATP Executive Officer for queries [i 
(b)(3) 10 U.S.C. 424 IMCON information is not permitted on the SECRET network (i.e., 
SIPRNET). 


= For NOFORN: 


(U//FSCGS; NOTICE: This document contains references to Sensitive Analytical Techniques 
(IMCON Information). Further reuse or dissemination of this information beyond USA requires 
written approval of the NGA Foreign Disclosure Officer. Contact the SAT Panel Executive Officer for 
eMevtesq(0)(3) 10 U.S.C. 424 IMCON information is not permitted on the SECRET 
network (i.e., SIPRNET) without prior written approval by the SAT Panel Chair. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): IMCON information 
may be sourced in accordance with relevant IC policy and/or procedures. See above precedence and commingling 


rules. 


(U) Notional Example Page 1: 


SECRET//IMCON/REL TO USA, AUS, CAN, GBR, NZL 


[Insert IMCON Notice] 


(S//IMC/REL TO USA, AUS, CAN, GBR, NZL) This is the portion mark for a portion that is classified SECRET 
CONTROLLED IMAGERY, and is authorized for release to Australia (AUS), Canada (CAN), United Kingdom 

(GBR), and New Zealand (NZL). This portion must contain only US classified information that is releasable to 
AUS, CAN, GBR, and NZL. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//IMCON/REL TO USA, AUS, CAN, GBR, NZL 
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(U) Notional Example Page 2: 


TOP SECRET//IMCON/NOFORN 
[Insert IMCON Notice] 


(S/IMC/REL TO USA, AUS, CAN, GBR, NZL) This is the portion mark for a portion that is classified SECRET 
CONTROLLED IMAGERY and is authorized for release to Australia (AUS), Canada (CAN), United Kingdom 
(GBR), and New Zealand (NZL). This portion must contain only US classified information that is releasable to 
AUS, CAN, GBR, and NZL. This portion is marked for training purposes only. 


(TS//NF) This is the portion mark for a portion that is classified TOP SECRET and not releasable to foreign 
nationals. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//IMCON/NOFORN 
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(U) Authorized Banner Line NOT RELEASABLE TO FOREIGN NATIONALS 


Marking Title: 

(U) Authorized Banner Line 

Abbreviation: oe 

(U) Authorized Portion Mark: NF 

(U) Example Banner Line: TOP SECRET//NOFORN 
(U) Example Portion Mark: (S//NF) 


(U) Marking Sponsor/Policy Basis: | DNI/National Security Act of 1947, as amended, §103 (c)(5) 


(U) Definition: NOFORN is an explicit foreign release marking used to indicate the information may not be released in 
any form to foreign governments, foreign nationals, foreign organizations, or non-US citizens without permission of the 
originator and in accordance with provisions of, ICD 403, NDP-1, and implementation guidance in this document. 


(U) Further Guidance: 
=  IRPTA 2004 
EO 13526 
EO 12333, as amended 
ICPG 403.1 
ICD 710 
ICPG 710.2/403.5 
NDP-1 
Specific DNI CONOPS or other policy issuances specific to US support to ensure proper handling requirements 
are met 


(U) Applicability: Available for use by all IC agencies. 
(U) Additional Marking Instructions: Applicable to unclassified and classified information. 


(U) Relationship(s) to Other Markings: 
= May be used with TOP SECRET, SECRET, CONFIDENTIAL or UNCLASSIFIED. 
= Cannot be used with REL TO, RELIDO, EYES ONLY, or DISPLAY ONLY. 


Note: NSA is the only agency granted a control markings waiver for the continued use of the EYES ONLY marking 
through 9 September 2016, at which time it will expire automatically. Automated systems will be modified to reject 
information marked EYES ONLY beginning 01 October 2017. 


(U) Precedence Rules for Banner Line Guidance: Refer to Section D.2., Table 3 FD&R Markings Precedence Rules 
for Banner Line Roll-Up for guidance. 


(U) Commingling Rule(s) Within a Portion: May be combined with other caveated information when appropriate and 
the NF marking is conveyed in the portion mark. 


(U) Notes: 
= NOFORN is the most restrictive foreign disclosure and release marking. 
= Unclassified information and unclassified information with dissemination controls may be marked explicitly with 
NOFORN at the portion and banner level as circumstances warrant. Explicit foreign disclosure and release 
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markings are not required on unclassified information. Follow internal agency procedures for the use of 
NOFORN with unclassified information. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): NOFORN information 
may be sourced in accordance with relevant IC policy and/or procedures. See above precedence and commingling 
rules. 


(U) Notional Example Page 1: 


TOP SECRET//NOFORN 


(TS//NF) This is the portion mark for a portion that is classified TOP SECRET not releasable to foreign nationals. 
This portion is marked for training purposes only. 


(S//REL TO USA, JPN) This is the portion mark for a portion that is classified SECRET and is authorized for release 
to Japan (JPN). This portion must contain only US classified information that is releasable to JPN. This portion is 
marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing Directive 
and General Marking Guidance Section of this document for more information. 


TOP SECRET//NOFORN 


(U) Notional Example Page 2: 


SECRET//NOFORN 


(S//REL TO USA, JPN) This is the portion mark for a portion that is classified SECRET and is authorized for release 
to Japan (JPN). This portion must contain only US classified information that is releasable to JPN. This portion is 
marked for training purposes only. 


(C//RELIDO) This is the portion mark for a portion that is classified CONFIDENTIAL and the originator has explicitly 
deferred the foreign disclosure and release determination to a SFDRA. This portion is marked for training purposes 
only. 


(U) Note: Documents containing multiple portions with different foreign disclosure or release markings must be 
marked overall with the most protective marking, in this case NOFORN is appropriate because not all portions are 
marked releasable to JPN. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN 


146 
UNCLASSIFIED//resxs— 


348 


349 


UNCLASSIFIED/ ee 
(U) Notional Example Page 3: 


SECRET//NOFORN//LES 


(S//REL TO USA, JPN) This is the portion mark for a portion that is classified SECRET and is authorized for release 
to Japan (JPN). This portion must contain only US classified information that is releasable to JPN. This portion is 
marked for training purposes only. 


(U//LES-NF) This is the portion mark for a portion that is UNCLASSIFIED and contains LAW ENFORCEMENT 
SENSITIVE information not releasable to foreign nationals. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN//LES 
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(U) Authorized Banner Line Marking Title: CAUTION-PROPRIETARY INFORMATION INVOLVED 
(U) Authorized Banner Line Abbreviation: PROPIN 

(U) Authorized Portion Mark: PR 

(U) Example Banner Line: CONFIDENTIAL//PROPIN/[Explicit FD&R] 

(U) Example Portion Mark: (S//PR/[Explicit FD&R]) 

(U) Marking Sponsor/Policy Basis: DNI/ 18 USC 1905 


(U) Definition: Marking to identify information provided by a commercial firm or private source under an express or 
implied understanding that the information will be protected as a proprietary trade secret or proprietary data believed to 
have actual or potential value. This marking may be used on government proprietary information only when the 
government proprietary information can provide a contractor(s) an unfair advantage, such as US Government budget or 
financial information. 


(U) Applicability: Available for use by all IC elements. 


(U) Additional Marking Instructions: Applicable to unclassified and classified information. 


(U) Relationship(s) to Other Markings: 
= May be used with TOP SECRET, SECRET, CONFIDENTIAL or UNCLASSIFIED. 


(U) Precedence Rules for Banner Line Guidance: 
= The PROPIN marking must always appear in the banner line if any portion contains PROPIN information. 
= When a document contains PROPIN and FOUO portions; only PROPIN appears in the banner line. PROPIN 
takes precedence over FOUO in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other information when appropriate and the PR 
marking is conveyed in the portion mark. 


(U) Notes: 
= Must not be disseminated outside the federal government in any form without the express permission of the 
originator of the intelligence and provider of the proprietary information. 
= Precludes dissemination to contractors irrespective of their status to or within the US Government without the 
authorization of the originator of the intelligence and provider of the information. 


(U) Derivative use (i.e., re-use of information in whole or in part in intelligence products): PROPIN information 
may be sourced in accordance with relevant IC policy and/or procedures. See above precedence and commingling 
rules. 
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(U) Notional Example Page: 
SECRET//NOFORN/PROPIN 


(S//NF/PR) This is the portion mark for a portion that is classified SECRET CAUTION-PROPRIETARY INFORMATION 
INVOLVED and not releasable to foreign nationals. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing Directive 
and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN/PROPIN 
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(U) Authorized Banner Line Marking Title: 


(U) Authorized Banner Line Abbreviation: 


(U) Authorized Portion Mark (when the 
portion's country trigraphs and/or tetragraph list 
is different from the banner line REL TO 
marking): 


(U) Authorized Portion Mark (when the 
portion's country trigraphs and/or tetragraph list 
is the same as the banner line REL TO 
marking): 


(U) Example Banner Line: 


(U) Example Portion Mark: 


(U) Marking Sponsor/Policy Basis: 


AUTHORIZED FOR RELEASE TO [USA, LIST] 


REL TO [USA, LIST] 


REL TO [USA, LIST] 


REL 


TOP SECRET//REL TO USA, EGY, ISR 
(S//REL TO USA, TEYE) 
or 


(S//REL) when the portion's country trigraphs and/or tetragraph list 
is the same as the banner line REL TO marking 


DNI/National Security Act of 1947, as amended, §103 (c)(5) 


(U) Definition: REL TO is an explicit foreign disclosure and release marking to indicate the information has been 
predetermined by the originator to be releasable or has been released to the foreign country(ies)/international 
organization(s) indicated through established foreign disclosure procedures and channels and implementation 
guidance in this document. It is NOFORN to all other foreign country(ies)/international organization(s) not indicated in 
the REL TO marking. Per ICD 403, release is defined as the provision of classified intelligence, in writing or in any 
other medium, to authorized foreign recipients for retention. 


(U) Further Guidance: 
= IRPTA 2004 
EO 13526 
EO 12333, as amended 


ICPG 403.1 

ICD 710 

ICPG 710.2/403.5 
NDP-1 


requirements are met 


Updates to policy addressing the rescinded DCID 6/6,§IXF and DCID 6/7 are pending ODNI ICD 403 


Specific DNI CONOPS or other policy issuances specific to US support to ensure proper handling 


(U) Applicability: Available for use by all IC elements. 
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(U) Additional Marking Instructions: 


Applicable to unclassified and classified information. 

“[USA, LIST]” pertains to the string that contains “USA” followed by one or more Register, Annex B trigraph 
country code(s) or Register, Annex A tetragraph code(s), or Manual, Appendix B NATO/NAC markings used with 
the REL TO marking. “USA” must always appear first whenever the REL TO string is used to communicate 
release decisions either by the US or a Non-US entity. 

After “USA”, list the required one or more trigraph country codes in alphabetical order followed by tetragraph 
codes listed in alphabetical order. Each code is separated by a comma and a space. 

“REL TO USA’ or “REL USA” (i.e., there is not at least one country trigraph code or tetragraph code following the 
USA code), is not an authorized marking and is not allowed on US intelligence information. 

Country trigraph codes/tetragraph codes are followed by a single forward slash if more dissemination controls 
follow or a double forward slash if non-IC dissemination control markings follow. If no markings follow, then no 
text or separating characters follow the last country code/tetragraph code. 


(U) pore ope e le) to Other Markings: 


May be used with TOP SECRET, SECRET, CONFIDENTIAL, or UNCLASSIFIED. 

Cannot be used with NOFORN or EYES ONLY (Note: The EYES ONLY marking is only authorized for use by 
NSA through a markings waiver; it will no longer be an IC authorized marking after 01 October 2017.) 

May be used with RELIDO. 

May be used with DISPLAY ONLY. 

For use with RD and FRD, see RD and FRD sections of this manual 


(U) Precedence Rules for Banner Line Guidance: Refer to Section D.2., Table 3 FD&R Markings Precedence Rules 
for Banner Line Roll-Up for guidance. 


(U) Commingling Rule(s) Within a Portion: Information marked with a REL TO caveat may be combined with other 
caveated information when appropriate; however, the REL TO marking will convey in the portion mark only if all 
information in that portion is releasable to the same “[LIST]” value(s). 


(U) Moa 


Further foreign dissemination of the material (in any form) is authorized only after obtaining permission from the 
originator. 

ICD 403, and NDP-1. Follow internal agency procedures for obtaining foreign disclosure and release guidance on 
classified information. 

Unclassified information and unclassified information with dissemination controls may be explicitly marked with 
REL TO at the portion and banner level as circumstances warrant. Explicit foreign disclosure and release 
markings are not required on unclassified information. Follow internal agency procedures for the use of REL TO 
with unclassified information. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): May be sourced when 
appropriate provided that: 


393 


When extracting a portion marked with the “REL” abbreviation (e.g., S/REL) from a source document, carry 
forward the trigraph/tetragraph code(s) listed in the source document’s banner line REL TO marking to the new 
portion mark. (Example 1) 

When extracting a portion marked with the “REL TO [LIST]’” from a source document, carry forward the 
trigraph/tetragraph code(s) listed in the source document or taken from the instructions in the appropriate 
classification guide to the new portion mark. See above precedence and commingling rules. 
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(U) Notional Example Page 1: 


TOP SECRET//REL TO USA, EGY, ISR 


(TS//REL) This is the portion mark for a portion that is classified TOP SECRET authorized for release to Egypt 
(EGY) and Israel (ISR) (i.e., the same as the banner line). This portion is marked for training purposes only. 


(U) Note: When extracting a portion marked from a source document with the REL TO marking abbreviation “REL”, 
carry forward the trigraph/tetragraph code(s) listed in the source document’s banner line REL TO marking to the 
new portion mark, e.g., (TS//REL TO USA, EGY, ISR). 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//REL TO USA, EGY, ISR 


(U) Notional Example Page 2: 


SECRET//NOFORN 
(S//REL TO USA, FVEY) This is the portion mark for a portion that is classified SECRET, AUTHORIZED FOR 
RELEASE TO FVEY (i.e., USA, Australia, Canada, New Zealand and United Kingdom) and that the originator has 
determined is releasable by an information disclosure official. This portion is marked for training purposes only. 


(C) This is the portion mark for a portion that is classified CONFIDENTIAL. This portion is marked for training 
purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN 


(U) Notional Example Page 3: 


SECRET//NOFORN 


(S//REL TO USA, FVEY) This is the portion mark for a portion that is classified SECRET, AUTHORIZED FOR 
RELEASE TO FVEY (i.e., USA, Australia, Canada, New Zealand and United Kingdom) and that the originator has 
determined is releasable by an information disclosure official. This portion is marked for training purposes only. 


(C//REL TO USA, ISAF) This is the portion mark for a portion that is classified CONFIDENTIAL, AUTHORIZED 
FOR RELEASE TO ISAF. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN 
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(U) Notional Example Page 4: 


SECRET//NOFORN 


(S//REL TO USA, AUS) This is the portion mark for a portion that is classified SECRET authorized for release to 
Australia (AUS). This portion is marked for training purposes only. 


(C//RELIDO) This is the portion mark for a portion that is classified CONFIDENTIAL and the originator has 
explicitly deferred the foreign disclosure and release determination to a SFDRA. This portion is marked for training 
purposes only. 


(U) Note: Documents containing multiple portions with different foreign disclosure or release markings must be 
marked overall with the most protective marking. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN 
(U) Notional Example Page 5: 


SECRET//REL TO USA, NZL 


(S//REL TO USA, JPN, NZL) This is the portion mark for a portion that is classified SECRET authorized for release 
to Japan (JPN) and New Zealand (NZL). This portion is marked for training purposes only. 


(S//REL) This is the portion mark for a portion that is classified SECRET and authorized for release to NZL. The 
abbreviated “REL” portion mark may be used when a portion is releasable to exactly the same list of 
countries/organizations as are listed in the banner line REL TO marking”. This portion is marked for training 
purposes only. 


(U) Note: When extracting a portion marked with the “REL” abbreviation from a source document, carry forward 
the trigraph/tetragraph codes listed in the source document’ banner line REL TO marking to the new portion mark, 
e.g., (S//REL TO USA, NZL). 


(U) Note: REL TO with an overlap in the country lists, roll-ups to the most restrictive list. New Zealand appears in 
the banner line because this country appears in all portions. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 


Directive and General Marking Guidance Section of this document for more information. 
SECRET//REL TO USA, NZL 
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(U) Authorized Banner Line Marking Title: RELEASABLE BY INFORMATION DISCLOSURE 


OFFICIAL 
(U) Authorized Banner Line Abbreviation: RELIDO 
(U) Authorized Portion Mark: RELIDO 
(U) Example Banner Line: TOP SECRET//TK//RELIDO 
(U) Example Portion Mark: (S//REL TO USA, AUS/RELIDO) 
(U) Marking Sponsor/Policy Basis: DNI/National Security Act of 1947, as amended, §103 


(c)(5) 


(U) Definition: RELIDO is a permissive foreign disclosure and release marking used on information to indicate that 
the originator has authorized a Senior Foreign Disclosure and Release Authority (SFDRA) to make further sharing 
decisions for uncaveated intelligence material (intelligence with no restrictive dissemination controls) in accordance 
with the existing procedures, guidelines, and implementation guidance in this document. 


(U) Further Guidance: 


= ICD 403 

= ICD 401.1 

= 1ICD710 

= ICPG 710.2/403.5 


(U) Applicability: Available for use by all IC elements. 
(U) Additional Marking Instructions: Applicable to unclassified and classified information. 


(U) Relationship(s) to Other Markings: 
= May be used with TOP SECRET, SECRET, CONFIDENTIAL, or UNCLASSIFIED. 
= May be used independently or with REL TO. 
= Cannot be used with NOFORN or DISPLAY ONLY. 


(U) Precedence Rules for Banner Line Guidance: Refer to Section D.2., Table 3 FD&R Markings Precedence Rules for 
Banner Line Roll-Up for guidance. 


(U) Commingling Rule(s) Within a Portion: 
= May be combined with other caveated information when appropriate; however, the RELIDO marking is conveyed 
in the portion mark only when all combined information carries a RELIDO decision. 


(U) Notes: 
= Authorizes only SFDRAs to make further sharing decisions without consulting the originator. 
= Unclassified information and unclassified information with dissemination controls may be explicitly marked with 
RELIDO at the portion and banner level as circumstances warrant. Explicit foreign disclosure and release 
markings are not required on unclassified information. Follow internal agency procedures for the use of RELIDO 
with unclassified information. 
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(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): RELIDO information may 
be sourced in accordance with relevant IC policy and/or procedures. See commingling and precedence rules above. 


(U) Notional Example Page 1: 


TOP SECRET//TK//RELIDO 


(TS//TK//RELIDO) This is the portion mark for a portion that is classified TOP SECRET, contains TALENT 
KEYHOLE information that the originator has explicitly deferred the foreign disclosure and release determination 
toa SFDRA. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//TK//RELIDO 


(U) Notional Example Page 2: 


SECRET//RELIDO 


(S//RELIDO) This is the portion mark for a portion that is classified SECRET and the originator has explicitly 
deferred the foreign disclosure and release determination to a SFDRA. This portion is marked for training 
purposes only. 


(S//REL TO USA, AUS, CAN/RELIDO) This is the portion mark for a portion that is classified SECRET for which 
the originator has made a release decision for the listed countries and for which the originator has further 
determined is releasable by an information disclosure official. This portion is marked for training purposes only. 


(U) Note: Redaction of the “REL TO” designators by the SFDRA may be required before the material is released 
in accordance with existing guidance. 


(U) Note: The RELIDO marking is carried forward to the banner line because it appears on all portions. REL TO 
cannot be applied to the overall classification of the document, because a positive release decision to AUS and 
CAN has not been made for portion 1. NOFORN would not be added because RELIDO removes the limited 
exception to NOFORN in portions 1 and 2. The overall classification still allows further release by an SFDRA in 
accordance with existing sharing guidelines. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//RELIDO 
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(U) Notional Example Page 3: 


SECRET//NOFORN 


(S//RELIDO) This is the portion mark for a portion that is classified SECRET and the originator has explicitly 
deferred the foreign disclosure and release determination to a SFDRA. This permissive dissemination control 
marking has exactly the same effect as uncaveated SECRET for future sharing decisions by an SFDRA, but 
explicitly states that an SFDRA may make further sharing decisions in accordance with the existing procedures for 
uncaveated intelligence material (e.g., intelligence without restrictive dissemination controls). This portion is 
marked for training purposes only. 


(S//REL TO USA, AUS, CAN) This is the portion mark for a portion that is classified SECRET that the originator 
has made a release decision for the listed countries. This portion is marked for training purposes only. 


(U) Note: NOFORN must be added to the banner line, because it is the most protective marking. All portions must 
be marked as RELIDO for the RELIDO marking to appear in the banner line. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN 
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(U) Authorized Banner Line Marking Title: USA/[LIST] EYES ONLY 
(U) Authorized Banner Line Abbreviation: None 
(U) Authorized Portion Mark: EYES 


Note: Second Party countries do not need to be listed unless 
they are different from the countries listed in the EYES ONLY 
statement within the header and footer. If countries are 
different, the portion mark has the same format as the page 
marking listed above (i.e., USA/[country trigraphs] EYES 


ONLY). 
(U) Example Banner Line: SECRET//USA/CAN/GBR EYES ONLY 
(U) Example Portion Mark: (TS//EYES) 
(U) Marking Sponsor/Policy Basis: NSA/CSS Classification Manual 1-52 


(U) Definition: EYES ONLY is a foreign disclosure and release marking for use only on electrical SIGINT reporting. 
(U) Applicability: NSA only (See note below) 


(U) Additional Marking Instructions: Applicable to only classified information. 


(U) st nels ch to Other Markings: 
May only be used with TOP SECRET, SECRET and CONFIDENTIAL. 
= Used with one or more Second Party countries (Australia, Canada, Great Britain New Zealand), See Register, 
Annex B for trigraph country codes. 
= Country trigraph codes are separated by single forward slashes (USA first, others in alphabetical order). 
= Cannot be used with NOFORN or REL TO. 
= Can be used with RELIDO. 


(U) Precedence Rules for Banner Line Guidance: Refer to Section D.2., Table 3 FD&R Markings Precedence 
Rules for Banner Line Roll-Up. 


(U) Notes: The DNI has approved an extension to the waiver previously set to expire on 01 October 2016 for NSA to 


continue to use this marking through 01 October 2017 at which time the waiver will expire automatically. All IC 
systems that mark and disseminate intelligence information must be modified to reject information with the EYES 


ONLY markings beginning 1 October 2017. 


(U) Derivative use (i.e., re-use of information in whole or in part in intelligence products): When extracting 
EYES ONLY portions from SIGINT reporting, convert the EYES ONLY portion marks to REL TO. 
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(U) Notional Example Page: 


TOP SECRET//USA/CAN/GBR EYES ONLY 


(TS//EYES) This is the portion mark for a portion that is classified TOP SECRET USA/CAN/GBR EYES ONLY. This 
portion is marked for training purposes only. 


(U) Note: When extracting “EYES” abbreviated portions from SIGINT reporting convert the “EYES” portion marks to 
REL TO and carry forward the trigraph/tetragraph codes listed in the source document banner line to the new 
portion mark. 


(U) Note: The EYES ONLY marking is only authorized for use by NSA systems producing SIGINT reporting, it will 
no longer be an IC authorized marking after 9 September 2016. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//USA/CAN/GBR EYES ONLY 
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(U) Note: This marking will be evaluated for continued registration with the 14 November 2016 implementation of 
the Controlled Unclassified Information (CUI) Program. 


(U) Authorized Banner Line Marking Title: DEA SENSITIVE 

(U) Authorized Banner Line Abbreviation: None 

(U) Authorized Portion Mark: DSEN 

(U) Example Banner Line: UNCLASSIFIED//DEA SENSITIVE 

(U) Example Portion Mark: (U//DSEN) 

(U) Example Banner Line: SECRET//NOFORN/DEA SENSITIVE 

(U) Marking Sponsor/Policy Basis: DEA/Planning and Inspection Manual, Chapter 86 


(U) Definition: Unclassified information originated by DEA that requires protection against unauthorized disclosure to 
protect sources and methods of investigative activity, evidence, and the integrity of pretrial investigative reports. 


(U) Further Guidance: Control and Decontrol of DEA Sensitive Information Policy 


(U) Applicability: DoJ and DoD. 


(U) Additional Marking Instructions: Applicable only to unclassified information. 


(U) Relationship(s) to Other Markings: 
= May be used with TOP SECRET, SECRET, CONFIDENTIAL, or UNCLASSIFIED — see precedence and 
commingling rules. 


(U) Precedence Rules for Banner Line Guidance: If DSEN is contained in any portion of a document (classified or 
unclassified), it must appear in the banner line. When comingled with FOUO, DSEN supersedes FOUO in the banner 
line role-up. 


(U) conan Rule(s) Within a Portion: 

When a portion contains both DSEN and FOUO information, DSEN supersedes FOUO in the portion mark. 

= DSEN information may be commingled in the same portion with non-DSEN information (classified or 
unclassified) when appropriate and if the document includes source reference citations in accordance with 
ICD 206, Sourcing Requirements for Disseminated Analytic Products, dated 17 October 2007. 
e The DSEN marking is conveyed in the portion mark. 
e The DSEN information must be identified in the source reference citations as endnotes keyed to the 

relevant DSEN information in the document. 

= If the document does not include source reference citations in accordance with ICD 206, the DSEN portions 

must be segregated from all non-DSEN portions. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): 
= DSEN information may be sourced in accordance with relevant policy and/or procedures. See above 
precedence and commingling rules. 
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= Foreign disclosure and release determinations require prior approval of the originating agency. Until 
originator approval is obtained, mark DSEN portions as NOFORN when an FD&R marking is required as 
described in Section B, paragraph 3 of this document. 


(U) Warnings and Notices: 

= Distribution of DEA SENSITIVE information, material, and media outside DEA is prohibited except where 
there is a specific need for the information to be referred to other agencies for their information or action. 

= The following notation will be typed, labeled or stamped on each DEA SENSITIVE document or media sent to 
another agency: “(U) This document is the property of the DEA and may be distributed within the 
Federal Government (and its contractors), and to US intelligence, law enforcement, and public safety 
or protection officials with a need to know. Distribution beyond these entities without DEA 
authorization is strictly prohibited. Precautions should be taken to ensure this information is stored 
and/or destroyed in a manner that precludes unauthorized access. The use of information in this 
report is pre-approved for US government Intelligence Community products, including finished 
analytic products distributed to US Executive Branch departments/agencies. Cited portions must 
carry the same classification and controls, and readers of this report must hold all appropriate 
clearances. The information in this report may not be used in legal proceedings, for operational or 
intelligence collection activities, shared with foreign persons or agencies, entered into non-DEA 
databases for operational purposes or reproduced in additional formats unless express permission is 
granted by the DEA based on a written request (IJE 


(U) Notional Example Page 1: 


UNCLASSIFIED//DEA SENSITIVE 
[Insert DSEN Warning] 


(U//DSEN) This is the portion mark for a portion that is classified UNCLASSIFIED DEA SENSITIVE. This portion is 
marked for training purposes only. 


UNCLASSIFIED//DEA SENSITIVE 


(U) Notional Example Page 2: 


SECRET//NOFORN/DEA SENSITIVE 
[Insert DSEN Warning] 


(U//DSEN) This is the portion mark for a portion that is classified UNCLASSIFIED DEA SENSITIVE. This portion is 
marked for training purposes only. 


(S//NF/DSEN) This is the portion mark for a portion that is classified SECRET DEA SENSITIVE and not releasable 
to foreign nationals. This document must include source reference citations as endnotes keyed to the relevant 
DSEN information, as required by ICD 206. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN/DEA SENSITIVE 
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(U) Authorized Banner Line Marking Title: FOREIGN INTELLIGENCE SURVEILLANCE ACT 
(U) Authorized Banner Line Abbreviation: FISA 

(U) Authorized Portion Mark: FISA 

(U) Example Banner Line: TOP SECRET//FISA 

(U) Example Portion Mark: (TS//FISA) 

(U) Marking Sponsor/Policy Basis: DNI/US Code Title 50, Chapter 36 


(U) Definition: The Foreign Intelligence Surveillance Act (FISA) of 1978, as amended, prescribes procedures for the 
physical and electronic surveillance and collection of "foreign intelligence information" between or among "foreign 
powers" on territory under United States control. The marking denotes the presence of FISA material. 


(U) Further guidance: 
= The FISA statute provides that information collected pursuant to the statute "may not be disclosed for law 
enforcement purposes unless the disclosure is accompanied by a statement that such information, or any 
information derived there from, may be used in a criminal proceeding only with advance authorization of the 
Attorney General" (50 USC 1806, 1825, 1845). 
= The statement required by the FISA statute is commonly referred to as a "FISA Warning." 
= Contact originating agency or local security/legal office for specific guidance. 


(U) Applicability: Agency specific. 


(U) Additional Marking Instructions: 
= Applicable to unclassified and classified information. 
= This is an informational marking only to highlight FISA content and does not eliminate or alter the requirement 
to carry a FISA warning as required by law or organizational procedures. 


(U) Relationship(s) to Other Markings: 
«May be used with TOP SECRET, SECRET, CONFIDENTIAL, or UNCLASSIFIED. 


(U) Precedence Rules for Banner Line Guidance: If the FISA marking is contained in any portion of a document 
(classified or unclassified) it must appear in the banner line. 


(U) Commingling Rule(s) Within a Portion: May be combined with other unclassified or classified caveated 
information when appropriate and the FISA marking must be conveyed in the portion mark. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): FISA marked 
information may be sourced in accordance with relevant policy and/or procedures. See above precedence and 
commingling rules. 


(U) Warnings and Notices: Applicable FISA Warning(s) are to be collocated with the FISA information within the 
body of the document; however, due to formatting constraints of some electronically generated documents, the FISA 
Warning may appear in the header or footer of the document. 
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(U) Notional Example Page: 


TOP SECRET//NOFORN/FISA 
[Insert Applicable FISA Warning] 


(TS//NF/FISA) This is the portion mark for TOP SECRET FOREIGN INTELLIGENCE SURVEILLANCE ACT 
information that is not releasable to foreign nationals. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


TOP SECRET//NOFORN/FISA 
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(U) Authorized Banner Line Marking Title: DISPLAY ONLY [LIST] 

(U) Authorized Banner Line Abbreviation: None 

(U) Authorized Portion Mark: DISPLAY ONLY [LIST] 

(U) Example Banner Line: SECRET//DISPLAY ONLY IRQ 
(U) Example Portion Mark: (S//DISPLAY ONLY IRQ) 


(U) Example Banner Line with Multiple Countries: CONFIDENTIAL//DISPLAY ONLY AFG, IRQ 


(U) Example Portion Mark with Multiple Countries: (C//DISPLAY ONLY AFG, IRQ) 


(U) Marking Sponsor/Policy Basis: DNI National Security Act of 1947, as amended 


(U) Definition (Description): This marking indicates the information is authorized for disclosure without providing a 
physical copy for retention, regardless of medium to the foreign country(ies)/international organization(s) indicated, 
through established foreign disclosure procedures and channels, and implementation guidance in this document. Per 
ICD 403, disclosure is defined as displaying or revealing classified intelligence whether orally, in writing, or in any 
other medium to an authorized foreign recipient without providing the foreign recipient a copy of such information for 
retention. 


(U) Further Guidance: 
=  IRPTA 2004 
EO 13526 
EO 12333, as amended 
ICD 403.1 
ICD 710 
ICPG 710.2/403.5 
Specific DNI CONOPS or other policy issuances specific to US support to ensure proper handling 
requirements are met 


(U) Applicability: Available for use by all IC agencies. 


(U) Additional Marking Instructions: 
= Applicable to unclassified and classified information. 
= “[LIST]’ pertains to the Annex B country trigraph code(s) or Annex A tetragraph code(s), or Manual, Appendix 
B NATO/NAC markings used with the DISPLAY ONLY marking. Country codes are listed alphabetically 
followed by tetragraph codes in alphabetical order. Multiple codes must be separated by commas with an 
interjected space. Authorized codes are provided in the Register Annexes. 


(U) oe OTAR to Other Markings: 
May be used with TOP SECRET, SECRET, CONFIDENTIAL, or UNCLASSIFIED. 
= May not be used with any other dissemination control marking in the portion and banner line, unless 
consistent with IC directives and established intelligence sharing arrangements and procedures. For 
example, DNI policy may authorize the use of REL TO in conjunction with DISPLAY ONLY under certain 
circumstances. 
= Cannot be used with RELIDO or NOFORN. 
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(U) Precedence Rules for Banner Line Guidance: Refer to Section D.2., Table 3 FD&R Markings Precedence 
Rules for Banner Line Roll-Up. 


(U) Commingling Rule(s) Within a Portion: DISPLAY ONLY can be used in conjunction with REL TO when all 
information within the portion has been reviewed through the originator’s foreign disclosure channels and approved for 
disclosure and release to separate Register, Annex B trigraph country code(s) or Register, Annex A tetragraph 
code(s). 


(U) Notes: 

= Classified intelligence marked with DISPLAY ONLY is eligible for disclosure (not release) to the one or more 
Register, Annex B trigraph country code(s) or Register, Annex A tetragraph code(s) consistent with 
appropriate Executive Orders and IC directives/guidelines pertaining to the disclosure and release of 
classified intelligence information and in accordance with established international arrangements and 
appropriate foreign disclosure approval processes and procedures. 

= Classified intelligence marked DISPLAY ONLY may not be further disclosed beyond its original authorized 
intended use without prior approval of the originator and consistent with IC directives/quidelines and 
established intelligence sharing arrangements and procedures. 

= Classified intelligence marked DISPLAY ONLY must remain under US control and follow specified US control, 
handling, and storage procedures for classified information at all times. 

= Unclassified information and unclassified information with dissemination controls may be explicitly marked 
with DISPLAY ONLY at the portion and banner level as circumstances warrant. Explicit foreign disclosure 
and release markings are not required on unclassified information. Follow internal agency procedures for the 
use of DISPLAY ONLY with unclassified information. 


(U) Legacy documents (e.g., portions extracted, reintroduced into the working environment from a resting 
state): Information marked as SECRET SENSITIVE DISPLAY ONLY, DISPLAY ONLY TO [LIST], FOR DISPLAY 
ONLY [LIST], or other legacy marking to denote a disclosure decision must not be used in a new product. Any 
documents dated before publication of Register Version 4.1 that contain these markings should be referred to the 
originating agency prior to re-use. 


(U) Derivative Use: (i.e., re-use of information in whole or in part in other intelligence products): When the 
DISPLAY ONLY warning statement (noted below) is present on US classified intelligence information, derivative use 
of this information into other products, including other purposes, and other countries or international organizations is 
prohibited without prior authorization from the originating agency. Once authorization to use as a derivative source is 
received, remove the warning from the derived product. 


(U) Warnings and Notices: Information marked DISPLAY ONLY or when REL TO is used in conjunction with 
DISPLAY ONLY that is not authorized to be used as a derivative source into other products, must be marked with the 
following warning conspicuously located on the first page — top preferred: “(U) Derivative use of this DISPLAY 
ONLY or REL TO in conjunction with DISPLAY ONLY marked information into other products is prohibited 
without prior authorization from the originating agency. Disclosure of DISPLAY ONLY or REL TO in 
conjunction with DISPLAY ONLY information is not authorized for other purposes or for disclosure or release 
and disclosure to other countries, international organizations, or coalitions not specified in the banner line or 
portion mark. Removal of this warning is required once authorization is received by the originating agency.” 
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(U) Notional Example Page 1: 


SECRET//DISPLAY ONLY AFG 
[Insert DISPLAY ONLY warning when derivative use is not authorized by the originator] 


(S//DISPLAY ONLY AFG) This portion is classified SECRET and is authorized for DISPLAY ONLY Afghanistan 
(AFG). This portion is marked for training purposes only. 


(S//DISPLAY ONLY AFG) This portion is classified SECRET and is authorized for DISPLAY ONLY AFG. This 
portion is marked for training purposes only. 


(S//DISPLAY ONLY AFG) This portion is classified SECRET and is authorized for DISPLAY ONLY AFG. This 
portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//DISPLAY ONLY AFG 


(U) Notional Example Page 2: 


SECRET//DISPLAY ONLY AFG 
[Insert DISPLAY ONLY warning when derivative use is not authorized by the originator] 


(S//DISPLAY ONLY AFG) This portion is classified SECRET and is authorized for DISPLAY ONLY to 
Afghanistan (AFG). This portion is marked for training purposes only. 


(S//DISPLAY ONLY AFG, IRQ) This portion is classified SECRET and is authorized for DISPLAY ONLY to 
AFG and Iraq (IRQ). This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//DISPLAY ONLY AFG 
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(U) Notional Example Page 3: 


SECRET//NOFORN 
[Insert DISPLAY ONLY warning when derivative use is not authorized by the originator] 


(S//DISPLAY ONLY AFG) This portion is classified SECRET and is authorized for DISPLAY ONLY to 
Afghanistan (AFG). This portion is marked for training purposes only. 


(S//DISPLAY ONLY IRQ) This portion is classified SECRET and is authorized for DISPLAY ONLY to Iraq 
(IRQ). This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN 


(U) Notional Example Page 4: 


SECRET//DISPLAY ONLY IRQ 
[Insert DISPLAY ONLY warning when derivative use is not authorized by the originator] 


(S//REL TO USA, IRQ) This is the portion mark for a portion that is classified SECRET authorized for release 
to Iraq (IRQ). This portion is marked for training purposes only. 


(S//DISPLAY ONLY IRQ) This is the portion mark for a portion that is classified SECRET authorized for 
DISPLAY ONLY IRQ. This portion is marked for training purposes only. 


(U) Note: In this case, the roll-up to DISPLAY ONLY IRQ is the most restrictive marking and reflects that any 
US intelligence information approved for release to a given audience has automatically been approved for 
disclosure to that audience. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//DISPLAY ONLY IRQ 


166 
UNCLASSIFIED//rexs— 


368 


369 


UNCLASSIFIED/ /=6ee— 


(U) Notional Example Page 5: 


SECRET//REL TO USA, IRQ/DISPLAY ONLY AFG 
[Insert DISPLAY ONLY warning when derivative use is not authorized by the originator] 


(S//REL TO USA, IRQ/DISPLAY ONLY AFG) This portion is classified SECRET and is authorized for release 
to Iraq (IRQ) and DISPLAY ONLY to Afghanistan (AFG). This portion is marked for training purposes only. 


(S//REL TO USA, IRQ/DISPLAY ONLY AFG) This portion is classified SECRET and is authorized for release 
to IRQ and DISPLAY ONLY to AFG. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//REL TO USA, IRQ//DISPLAY ONLY AFG 
(U) Notional Example Page 6: 


SECRET//NOFORN 
[Insert DISPLAY ONLY warning when derivative use is not authorized by the originator] 


(S//REL TO USA, AFG/DISPLAY ONLY IRQ) This portion is classified SECRET and is authorized for release 
to Afghanistan (AFG) and DISPLAY ONLY to Iraq (IRQ). This portion is marked for training purposes only. 


(S//REL TO USA, GBR/DISPLAY ONLY PAK) This portion is classified SECRET and is authorized for release 
to United Kingdom (GBR) and DISPLAY ONLY to PAK. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN 
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(U) Notional Example Page 7: 


SECRET//NOFORN 
[Insert DISPLAY ONLY warning when derivative use is not authorized by the originator] 


(S//DISPLAY ONLY IRQ) This portion is classified SECRET and is authorized for DISPLAY ONLY to Iraq 
(IRQ). This portion is marked for training purposes only. 


(S//RELIDO) This portion is classified SECRET and the originator has explicitly deferred the foreign disclosure 
and release determination toa SFDRA. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN 
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9. (U) Non-Intelligence Community Dissemination Control Markings 


(U) General Information 


(U) Non-Intelligence Community (non-IC) dissemination control markings are those markings applied to non-IC 
information authorized by the DNI to be received and used within the IC and within the IC Information Technology 
Enterprise (IC ITE) and on legacy systems. These markings are included in the Register and Manual to provide guidance 
to IC classifiers on handling and reusing information that bear them. The markings in this category are restricted for use 
by specific agencies. Inclusion in this document does not authorize other agencies to use these markings. 


(U) Multiple entries may be used in the Non-Intelligence Community Dissemination Control Markings category if 
applicable. If multiple entries are used, list them in the order in which they appear in the Register. Use a single forward 
slash without an interjected space as the separator between multiple non-IC dissemination control markings. 


(U) The following non-IC dissemination control markings and their respective marking sponsor(s) are listed in the order as 
they appear in the Register. 


= LIMITED DISTRIBUTION (NGA) 

= EXCLUSIVE DISTRIBUTION (DoS) 

= NO DISTRIBUTION (DoS) 

= SENSITIVE BUT UNCLASSIFIED (DoS) 

= SENSITIVE BUT UNCLASSIFIED NOFORN (DoS) 

= LAW ENFORCEMENT SENSITIVE (Various Agencies) 

= LAW ENFORCEMENT SENSITIVE NOFORN (Various Agencies) 


= SENSITIVE SECURITY INFORMATION (DHS) 
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(U) Note: This marking will be evaluated for continued registration with the 14 November 2016 implementation of 
the Controlled Unclassified Information (CUI) Program. 


(U) Authorized Banner Line Marking Title: LIMITED DISTRIBUTION 

(U) Authorized Banner Line Abbreviation: LIMDIS 

(U) Authorized Portion mark: DS 

(U) Example Banner Line: UNCLASSIFIED//LIMITED DISTRIBUTION 
(U) Example Portion Mark: (U//DS) 

(U) Marking Sponsor/Policy Basis: NGA/10 USC, §455 


(U) Definition: Marking used to identify unclassified maps and geospatial products and data sets, which the Secretary 
of Defense may withhold from public release. Release or disclosure of these products is limited to Department of 
Defense (DOD) and DOD contractors (including any sub-contractors); for national intelligence purposes, to the 
Director of National Intelligence (DNI), non-DOD members of the Intelligence Community (IC), and the National 
Security Council (NSC); and, with permission from NGA, to other federal government departments and agencies. 


Contact NGA Disclosure and Release for further guidance (S]/@)MIOIURSKenr 7) 
(b)(3) 10 U.S.C. 424 


(U) Further Guidance: 
= NSG GEOINT Security Classification Guide 
=  NSGM documentation 


(U) Applicability: National Geospatial-Intelligence Agency (NGA). 


(U) dea iain Marking Instructions: 
Applicable only to unclassified information. 
= Portion Marking: LIMDIS is typically not associated with textual intelligence/GEOINT reporting. “(U//DS)” may be 
used to mark references to LIMDIS products within software systems or entire NGA product lines. “(U//DS)” may 
be used as a portion mark for a paragraph that contains a viewable LIMDIS geospatial product. 


(U) Relationship(s) to Other Markings: May only be used with UNCLASSIFIED. 


(U) Precedence Rules for Banner Line Guidance: 
= The LIMDIS marking always appears in the banner line of an unclassified document, if it is contained in any 
portion. 
= When a document contains only LIMDIS and FOUO portions, LIMDIS supersedes FOUO in the banner line. 
= When a document contains LIMDIS and classified portions, LIMDIS is not used in the banner line. 


(U) Commingling Rule(s) Within a Portion: May not be combined with non-LIMDIS unclassified, specific copyrighted, or 
FOUO information. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): 
= Derivative classifiers who receive and source LIMDIS information MUST carry forward the LIMDIS marking. 
= Carry forward the LIMDIS warning statement when the information is reused with unclassified information. 
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= Do not apply the LIMDIS warning when the LIMDIS information reused in a document with classified 
information. 

= Foreign disclosure and release determinations require prior approval of the originating agency (NGA). If a higher 
classified product contains LIMDIS information and must be shared with foreign nationals, contact the 
NGA foreign disclosure and release POC (see above). Until originator approval is obtained, mark LIMDIS 
portions as NOFORN when an FD&R marking is required as described in Section B, paragraph 3 of this 
document. 


(U) Warnings and Notices: LIMDIS geospatial data must be marked with the LIMDIS warning. See the Notional 
Example for the text of the required LIMDIS warning (bolded text). 


(U) Notional Example Page 1: 
UNCLASSIFIED//LIMITED DISTRIBUTION 


(U//DS) This is the portion mark for a portion that is UNCLASSIFIED LIMITED DISTRIBUTION. This portion is 
marked for training purposes only. 


(U) Distribution authorized to DoD, IAW 10 U.S.C. §§130 & 455. Release authorized to U.S. DoD 
contractors IAW 48 C.F.R §252.245-7000. Refer other requests to: Headquarters, NGA, ATTN: Release 
Officer, Mail Stop S82-OlA, 7500 GEOINT Drive, Springfield, VA 22150. Destroy IAW DoDD 5030.59. 
Removal of this caveat is prohibited. 


UNCLASSIFIED//LIMITED DISTRIBUTION 
(U) Notional Example Page 2: 


SECRET//NOFORN 


(U//DS) This is the portion mark for a portion that is UNCLASSIFIED LIMITED DISTRIBUTION. This portion is 
marked for training purposes only. 


(S//NF) This is the portion mark for a portion that is classified SECRET and not releasable to foreign nationals. 
This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN 


171 
UNCLASSIFIED//rexs— 


373 


374 


374 


UNCLASSIFIED/ /=6ese— 


(U) Authorized Banner Line Marking Title: EXCLUSIVE DISTRIBUTION 
(U) Authorized Banner Line Abbreviation: EXDIS 

(U) Authorized Portion Mark: XD 

(U) Example Banner Line: SECRET//NOFORN//EXDIS 
(U) Example Portion Mark: (S//NF//XD) 

(U) Marking Sponsor/Policy Basis: DoS/5 FAH-2 §H-442.6 


(U) Definition: Information with exclusive distribution to officers with essential need-to-know. This caption is used 
only for highly sensitive traffic between the White House, the Secretary, Deputy, or Under Secretaries of State and 
Chiefs of Missions. 


(U) Further Guidance: 
= 12 FAM 539.3 
= 5 FAH 4 §H-213 


(U) Applicability: Department of State. 


(U) Additional Marking Instructions: Applicable to classified and unclassified administratively controlled information 
(administratively controlled is SBU information). 


(U) Relationship(s) to Other Markings: 
«May be used with TOP SECRET, SECRET, CONFIDENTIAL, or UNCLASSIFIED. 
= EXDIS and NODIS markings cannot be used together. 
= Requires NOFORN. 


(U) Precedence Rules for Banner Line Guidance: 

= NODIS has priority over EXDIS in the banner line if both NODIS and EXDIS portions are in the same 
document. 

= |f EXDIS is contained in any portion of a document that does not contain one or more NODIS portions, EXDIS 
must appear in the banner line. 

= REL TO is not authorized in the banner line if any portion contains EXDIS information. In this case, NOFORN 
would convey in the banner line. 

= EXDIS takes precedence in the banner line over SBU and SBU NOFORN or FOUO in an unclassified 
document. 


(U) commingling Rule(s) Within a Portion: 

EXDIS information may be commingled with SBU/SBU-NF or FOUO information within the same portion, and 
the EXDIS (XD) supersedes the SBU, SBU-NF, and/or FOUO in the portion mark. 

= When a portion contains both EXDIS and NODIS information, NODIS (ND) supersedes EXDIS (XD) in the 
portion mark. 

= EXDIS information may be commingled in the same portion with non-EXDIS information (classified or 
unclassified) when appropriate and if the document includes source reference citations in accordance with 
ICD 206, Sourcing Requirements for Disseminated Analytic Products, dated 17 October 2007. 
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e The XD marking is conveyed in the portion mark (unless commingled with NODIS, see previous rule). 

e The EXDIS information must be identified in the source reference citations as endnotes keyed to the 
relevant EXDIS information in the document. 

If the document does not include source reference citations in accordance with ICD 206, the EXDIS portions 

must be segregated from all non-EXDIS portions. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): 


= Contact the State Department Executive Secretariat at 202-647-1512 for approval to re-use material marked 
EXDIS. 


= Until originator approval is obtained, mark EXDIS portions as NOFORN when an FD&R marking is required 
as described in Section B, paragraph 3 of this document. 


(U) Notional Example Page: 


SECRET//NOFORN//EXDIS 


(S//NF//XD) This is the portion mark for a portion that is classified SECRET EXCLUSIVE DISTRIBUTION and not 
releasable to foreign nationals. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN//EXDIS 
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(U) Authorized Banner Line Marking Title: NO DISTRIBUTION 

(U) Authorized Banner Line Abbreviation: NODIS 

(U) Authorized Portion Mark: ND 

(U) Example Banner Line: SECRET//NOFORN//NO DISTRIBUTION 
(U) Example Portion Mark: (S//NF//ND) 

(U) Marking Sponsor/Policy Basis: DoS/5 FAH-2 §H-442.3 


(U) Definition: This control is used only on messages of the highest sensitivity between the President, the Secretary 
of State, and Chief of Mission. No further dissemination is allowed to any other than the original addressee(s) without 
the approval of the Executive Secretary. 


(U) Further Guidance: 
= 12 FAM 539.3 
= 5 FAH 4 §H-213 


(U) Applicability: Department of State. 


(U) Additional Marking Instructions: Applicable to classified and unclassified administratively controlled information 
(administratively controlled is SBU information). 


(U) Relationship(s) to Other Markings: 
= May be used with TOP SECRET, SECRET, CONFIDENTIAL, or UNCLASSIFIED. 
= NODIS and EXDIS markings cannot be used together. 
= Requires NOFORN. 


(U) Precedence Rules for Banner Line Guidance: 

= NODIS has priority over EXDIS in the banner line if both NODIS and EXDIS portions are in the same 
document. 

= If NODIS is contained in any portion of a document, it must appear in the banner line. 

= REL TO is not authorized in the banner line if any portion contains NODIS information. In this case, 
NOFORN would convey in the banner line. 

= NODIS takes precedence over SBU and SBU NOFORN or FOUO in the banner line in an unclassified 
document. 


(U) commingling Rule(s) Within a Portion: 

NODIS information may be commingled with SBU/SBU-NF or FOUO information within the same portion, and 
the NODIS (ND) supersedes the SBU/SBU-NF or FOUO in the portion mark. 

= If a portion contains both NODIS and EXDIS information, NODIS (ND) supersedes EXDIS (XD) in the portion 
mark. 

= NODIS information may be commingled in the same portion with non-NODIS information (classified or 
unclassified) when appropriate and if the document includes source reference citations in accordance with 
ICD 206, Sourcing Requirements for Disseminated Analytic Products, dated 17 October 2007. 
e The ND marking is conveyed in the portion mark. 
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e The NODIS information must be identified in the source reference citations as endnotes keyed to the 


relevant NODIS information in the document. 


If the document does not include source reference citations in accordance with ICD 206, the NODIS portions 
must be segregated from all non-NODIS portions. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): 


= Contact the State Department Executive Secretariat at 202-647-1512 for approval to re-use material marked 
NODIS. 


= Until originator approval is obtained, mark NODIS portions as NOFORN when an FD&R marking is required 
as described in Section B, paragraph 3 of this document. 


(U) Notional Example Page: 


SECRET//NOFORN//NODIS 


(S//NF//ND) This is the portion mark for a portion that is classified SECRET NO DISTRIBUTION and not releasable 
to foreign nationals. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN//NODIS 
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(U) Note: This marking will be evaluated for continued registration with the 14 November 2016 implementation of 
the Controlled Unclassified Information (CUI) Program. 


(U) Authorized Banner Line Marking Title: SENSITIVE BUT UNCLASSIFIED 

(U) Authorized Banner Line Abbreviation: SBU 

(U) Authorized Portion Mark: SBU 

(U) Example Banner Line: UNCLASSIFIED//SENSITIVE BUT UNCLASSIFIED 
(U) Example Portion Mark: (U//SBU) 

(U) Marking Sponsor/Policy Basis: DoS/12 FAM, §540 


(U) Definition: Administrative unclassified information originated from within the Department of State, which warrants 
a degree of protection and administrative control and meets criteria for exemption from mandatory public disclosure 
under the Freedom of Information Act. 


(U) Further Guidance: None. 
(U) Applicability: Department of State. 


(U) Additional Marking Instructions: Applicable only to unclassified information. 
(U) Relationship(s) to Other Markings: May only be used with UNCLASSIFIED. 


(U) Preece ce Rules for Banner Line Guidance: 
The SBU marking always appears in the banner line of an unclassified document if it is contained in any 
portion. 
= When a document contains only SBU and FOUO portions, SBU supersedes FOUO in the banner line. 
= When a document contains SBU and classified portions, SBU is not used in the banner line. 


(U) commingling Rule(s) Within a Portion: 
When a portion contains both SBU and FOUO information, SBU supersedes FOUO in the portion mark. 
= SBU information may be commingled in the same portion with non-SBU information (classified or 
unclassified) when appropriate and if the document includes source reference citations in accordance with 
ICD 206, Sourcing Requirements for Disseminated Analytic Products, dated 17 October 2007. 
e The SBU marking is conveyed in the portion mark only if the commingled portion is unclassified. 
e Ifthe portion is classified, the classification level of the portion adequately protects the SBU information, 
and SBU is not reflected in the portion mark. 
e |f commingled, the SBU information must be identified in the source reference citations as endnotes 
keyed to the relevant SBU information in the document. 
= — If the document does not include source reference citations in accordance with ICD 206, the SBU portions 
must be segregated from all non-SBU portions. 
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(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): 
= SBU information may be sourced in accordance with relevant policy and/or procedures. See above 
precedence and commingling rules. 
= Foreign disclosure and release determinations require prior approval of the originating agency. Until 


originator approval is obtained, mark SBU portions as NOFORN when an FD&R marking is required as 
described in Section B, paragraph 3 of this document. 


(U) Notional Example Page 1: 


UNCLASSIFIED//SBU/SSI 


(U//SBU) This is the portion mark for a portion that is SENSITIVE BUT UNCLASSIFIED. This portion is marked for 
training purposes only. 


(U//SBU/SSI) This is the portion mark for a portion that is SENSITIVE BUT UNCLASSIFIED and contains 
SPECIAL SECURITY INFORMATION (SSI). This document must be sourced in accordance with ICD 206 to 
ensure the SBU and SSI information includes source reference citations as endnotes keyed to the relevant 
information in the disseminated analytic product. This portion is marked for training purposes only. 


(U//FOUO) This is the portion mark for an UNCLASSIFIED FOR OFFICIAL USE ONLY portion. This portion is 
marked for training purposes only. 


UNCLASSIFIED//SBU/SSI 
(U) Notional Example Page 2: 


SECRET//NOFORN 


(U//SBU) This is the portion mark for a portion that is SENSITIVE BUT UNCLASSIFIED. This portion is marked for 
training purposes only. 


(S//NF) This is the portion mark for a SECRET portion that is not releasable to foreign nationals. This portion is 
marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN 
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(U) Note: This marking will be evaluated for continued registration with the 14 November 2016 implementation of 
the Controlled Unclassified Information (CUI) Program. 


(U) Authorized Banner Line Marking Title: SENSITIVE BUT UNCLASSIFIED NOFORN 
(U) Authorized Banner Line Abbreviation: SBU NOFORN 

(U) Authorized Portion Mark: SBU-NF 

(U) Example Banner Line: UNCLASSIFIED//SBU NOFORN 

(U) Example Portion Mark: (U//SBU-NF) 

(U) Marking Sponsor/Policy Basis: DoS/12 FAM, §540 


(U) Definition: Administrative unclassified Information originated within the Department of State that warrants a degree of 
protection and administrative control, meets criteria for exemption from mandatory public disclosure under the Freedom of 
Information Act, and is prohibited for dissemination to non-US citizens. 


(U) Applicability: Department of State. 


(U) Further Guidance: None. 


(U) Additional Marking Instructions: Applicable only to unclassified information. 


(U) Relationship(s) to Other Markings: May only be used with UNCLASSIFIED. 


(U) Precedence Rules for Banner Line Guidance: 


When a document contains both SBU-NF and FOUO portions, SBU NOFORN supersedes FOUO in the banner 
line. 

When a document contains both SBU-NF and SBU portions, SBU NOFORN supersedes SBU in the banner line. 
Refer to Section D.2., Table 3 FD&R Markings Precedence Rules for Banner Line Roll-Up for SBU NOFORN 
FD&R markings guidance. 


(U) commingling Rule(s) Within a Portion: 


When a portion contains both SBU NOFORN and FOUO information, SBU-NF supersedes FOUO in the portion 

mark. 

SBU-NF information may be commingled in the same portion with non-SBU-NF information (classified or 

unclassified) when appropriate and if the document includes source reference citations in accordance with ICD 

206, Sourcing Requirements for Disseminated Analytic Products, dated 17 October 2007. 

e The SBU-NF marking is conveyed in the portion mark only if the commingled portion is unclassified and there 
is no other NOFORN information included in the portion. If there is other NOFORN information in the 
commingled portion, the “SBU” marking is used and a NOFORN marking is added, e.g., (U//NF//SBU). 

e If the portion is classified, the classification level of the portion adequately protects the SBU information, so 
SBU is not reflected in the portion mark; however a NOFORN marking must be added to the portion mark, 
e.g., (C//NF). 

e |f commingled, the SBU-NF information must be identified in the source reference citations as endnotes 
keyed to the relevant SBU-NF information in the document. 

If the document does not include source reference citations in accordance with ICD 206, the SBU-NF portions 

must be segregated from all non-SBU-NF portions. 
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(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): SBU-NF information 


may be sourced in accordance with relevant policy and/or procedures. See above precedence and commingling rules 
and Section B, paragraph 3 of this document. 


(U) Notional Example Page 1: 


UNCLASSIFIED//SBU NOFORN 


(U//SBU-NF) This is the portion mark for a portion that is SENSITIVE BUT UNCLASSIFIED NOFORN. This 
portion is marked for training purposes only. 


(U//FOUO) This is the portion mark for an UNCLASSIFIED FOR OFFICIAL USE ONLY portion. This portion is 
marked for training purposes only. 


UNCLASSIFIED//SBU NOFORN 


(U) Notional Example Page 2: 


SECRET//NOFORN 


(U//SBU-NF) This is the portion mark for a portion that is SENSITIVE BUT UNCLASSIFIED NOFORN. This 
portion is marked for training purposes only. 


(U//FOUO) This is the portion mark for an UNCLASSIFIED FOR OFFICIAL USE ONLY portion. This portion is 
marked for training purposes only. 


(S//REL TO USA, AUS) This is the portion mark for a portion that is classified SECRET authorized for release to 
Australia (AUS). This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN 
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(U) Notional Example Page 3: 


UNCLASSIFIED//NOFORN//SBU 


(U//SBU-NF) This is the portion mark for a portion that is SENSITIVE BUT UNCLASSIFIED NOFORN. This 
portion is marked for training purposes only. 


(U//FOUO/NF) This is the portion mark for an UNCLASSIFIED FOR OFFICIAL USE ONLY portion that is 
NOFORN. This portion is marked for training purposes only. 


UNCLASSIFIED//NOFORN//SBU 


(U) Notional Example Page 4: 


UNCLASSIFIED//NOFORN//SBU 


(U//SBU-NF) This is the portion mark for a portion that is SENSITIVE BUT UNCLASSIFIED NOFORN. This 
portion is marked for training purposes only. 


(U//REL TO USA, FVEY) This is the portion mark for an UNCLASSIFIED portion AUTHORIZED FOR RELEASE 
TO FVEY (i.e., USA, Australia, Canada, New Zealand and United Kingdom). This portion is marked for training 
purposes only. 


UNCLASSIFIED//NOFORN//SBU 
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(U) Note: This marking will be evaluated for continued registration with the 14 November 2016 implementation of 
the Controlled Unclassified Information (CUI) Program. 


(U) Authorized Banner Line Marking Title: LAW ENFORCEMENT SENSITIVE 
(U) Authorized Banner Line Abbreviation: LES 

(U) Authorized Portion Mark: LES 

(U) Example Banner Line: UNCLASSIFIED//LES 

(U) Example Portion Mark: (U//LES) 


Various Agencies or elements/Various applicable agency 


(U) Marking Sponsor/Policy Basis: policies and directives 


(U) Definition: LAW ENFORCEMENT SENSITIVE (LES) information is unclassified information originated by agencies 
or elements with law enforcement missions that may be used in criminal prosecution and that requires protection against 
unauthorized disclosure to protect sources and methods, investigative activity, evidence, or the integrity of pretrial 
investigative reports. Any law enforcement agency employee or contractor in the course of performing assigned duties 
may designate information as LES if authorized to do so pursuant to department specific policy and directives. 


(U) LES is a content indicator and handling caveat that indicates the information so marked was compiled for law 
enforcement purposes and contains operational law enforcement information or information that would reveal sensitive 
investigative techniques. LES information may be released or disclosed to foreign persons, organizations or governments 
with prior approval of the originating agency and in accordance with all applicable DNI foreign sharing agreements and 
directives. 


(U) Further Guidance: Agencies or elements that use the LES marking must maintain agency-specific implementation 
guidelines. 


(U) Applicability: Agencies or elements with a law enforcement mission. 
(U) Additional Marking Instructions: Applicable only to unclassified information. 


(U) Relationship(s) to Other Markings: 
= May be used with TOP SECRET, SECRET, CONFIDENTIAL, or UNCLASSIFIED 
= May be used with REL TO USA, [LIST] if the originating agency has granted release of the LES information to 
countries in the [LIST]. 


(U) Precedence Rules for Banner Line Guidance: 
= The LES marking always appears in the banner line if contained in any portion, regardless of classification level. 
= When a document contains both (U//FOUO) and (U//LES) information, LES takes precedence in the banner line. 


(U) Commingling Rule(s) Within a Portion: 
When a portion contains both LES and FOUO information, LES supersedes FOUO in the portion mark. 
= LES information may be commingled in the same portion with non-LES information (classified or unclassified) 
when appropriate and if the document includes source reference citations in accordance with ICD 206, Sourcing 
Requirements for Disseminated Analytic Products, dated 17 October 2007. 
e The LES marking is conveyed in the portion mark. 
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e The LES information must be identified in the source reference citations as endnotes keyed to the relevant 
LES information in the document. 
= If the document does not include source reference citations in accordance with ICD 206, the LES portions must 
be segregated from all non-LES portions. 


(U) Notes: 
= Agencies that originate LES information may choose to disseminate the information that they have caveated LES 
by posting on a website, on a classified network, or an unclassified virtual private network with proper access 
controls. However, if the originating agency chooses to disseminate such intelligence only on a point-to-point 

basis, the warning statement will be expanded to include the statement, "Recipients are prohibited from 
subsequently posting the information marked LES on a website or an unclassified network." 

= Information bearing the LES warning statement may not be used in legal proceedings without first receiving 
authorization from the originator. 

= The originating organization may authorize other sharing of LES information (for example, with victims of a crime) 
when the specific circumstances justify it. If such request is granted, it is the responsibility of the individual who is 
sharing the information to educate its recipient on how the information must be used and protected. 

= Unclassified LES information is withheld from public release until approved by the originator. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): 
= Derivative classifiers who receive and source LES information should carry forward the LES markings (to include 
the LES warning statement) on the information designated and marked as such. See above precedence and 
commingling rules. 
= Foreign disclosure and release determinations require prior approval of the originating agency. Until originator 
approval is obtained, mark LES portions as NOFORN when an FD&R marking is required as described in Section 
B, paragraph 3 of this document. 


(U) Warnings and Notices: Documents containing LES information must be marked on the first page with the following 
warning statement: “(U) LAW ENFORCEMENT SENSITIVE: The information marked (U//LES) in this document is 
the property of (insert agency name here) and may be distributed within the Federal Government (and its 
contractors), US intelligence, law enforcement, public safety or protection officials and individuals with a need to 
know. Distribution beyond these entities without (insert agency name here) authorization is prohibited. 
Precautions should be taken to ensure this information is stored and/or destroyed in a manner that precludes 
unauthorized access. Information bearing the LES caveat may not be used in legal proceedings without first 
receiving authorization from the originating agency. Recipients are prohibited from subsequently posting the 
information marked LES on a website or an unclassified network.” 


(U) Notional Example Page 1: 


UNCLASSIFIED//LES 
[Insert LES Warning] 


(U//LES) This is the portion mark for a portion that is UNCLASSIFIED and contains LES information. This 
portion is marked for training purposes only. 


(U) This is the portion mark for a portion that is UNCLASSIFIED. This portion is marked for training purposes 
only. 


UNCLASSIFIED//LES 
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(U) Notional Example Page 2: 


UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE 
[Insert LES Warning] 


(U//LES) This is the portion mark for a portion that is UNCLASSIFIED and contains LES information. This 
portion is marked for training purposes only. 


(U//FOUO) This is the portion mark for a portion that is UNCLASSIFIED and contains FOR OFFICIAL USE 
ONLY information. This portion is marked for training purposes only. 


UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE 


(U) Notional Example Page 3: 


SECRET//REL TO USA, FVEY//LES 
[Insert LES Warning] 


(S//REL TO USA, FVEY) This is the portion mark for a portion that is classified SECRET, AUTHORIZED FOR 
RELEASE TO FVEY (i.e., USA, Australia, Canada, New Zealand and United Kingdom). This portion is marked 
for training purposes only. 


(U//LES//REL TO USA, FVEY) This is the portion mark for a portion that is UNCLASSIFIED and contains LES 
information. Because the originating agency has given authorization (in accordance with all DNI and applicable 
originating agency foreign disclosure and release policy) to release the LES information to the FIVE EYES it is 
included in this document. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//REL TO USA, FVEY//LES 
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(U) Notional Example Page 4: 


SECRET//NOFORN//LES 
[Insert LES Warning] 


(S//NF) This is the portion mark for a portion that is SECRET and not authorized for foreign disclosure or 
release. This portion is marked for training purposes only. 


(U//LES) This is the portion mark for a portion that is UNCLASSIFIED and contains LES information. This 
portion is marked for training purposes only. The originating agency of the LES information has not restricted 


foreign disclosure and release of the LES information; however, because the classified information is NOFORN, 
the banner line must be NOFORN. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN//LES 
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(U) Note: This marking will be evaluated for continued registration with 14 November 2016 implementation of the 
Controlled Unclassified Information (CUI) Program. 


(U) Authorized Banner Line Marking Title: LAW ENFORCEMENT SENSITIVE NOFORN 
(U) Authorized Banner Line Abbreviation: LES NOFORN 

(U) Authorized Portion Mark: LES-NF 

(U) Example Banner Line: UNCLASSIFIED//LES NOFORN 

(U) Example Portion Mark: (U//LES-NF) 


Various agencies or elements/Various applicable agency 


(U) Marking Sponsor/Policy Basis: policies and directives 


(U) Definition: LAW ENFORCEMENT SENSITIVE NOFORN (LES-NF) information is unclassified information 
originated by agencies with law enforcement missions that may be used in criminal prosecution and requires 
protection against unauthorized disclosure to protect sources and methods, investigative activity, evidence, or the 
integrity of pretrial investigative reports, and is prohibited from dissemination to foreign nationals. Any law 
enforcement agency employee or contractor in the course of performing assigned duties may designate information 
as LES NOFORN if authorized to do so pursuant to department-specific policies and directives. 


(U) LES NOFORN is a content indicator and handling caveat that indicates the information so marked was compiled 
for law enforcement purposes and contains operational law enforcement information or information that would reveal 
sensitive investigative techniques. LES NOFORN information may not be released or disclosed to foreign persons, 
organizations or governments. 


(U) Further Guidance: Agencies that use the LES NOFORN marking must maintain agency-specific implementation 
guidelines. 


(U) Applicability: Agencies or elements with a Law Enforcement mission. 


(U) Additional Marking Instructions: Applicable only to unclassified information. 


(U) Relationship(s) to Other Markings: May be used with TOP SECRET, SECRET, CONFIDENTIAL, or 
UNCLASSIFIED. 


(U) Precedence Rules for Banner Line Guidance: 

= The LES marking always appears in the banner line if LES information (either LES or LES NOFORN) is 
contained in the document, regardless of the document's classification level. 

= When a classified document contains portions of U//LES-NF, the “LES” marking is used in the banner line and 
the NOFORN marking is applied as a Dissemination Control Marking. For example: 
SECRET//NOFORN//LES. 

= When an unclassified document contains both (U//FOUO) and (U//LES-NF) information, LES NOFORN takes 
precedence in the banner line. 

= Refer to Section D.2., Table 3 FD&R Markings Precedence Rules for Banner Line Roll-Up for LES NOFORN 
FD&R markings guidance. 
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(U) commingling Rule(s) Within a Portion: 
When a portion contains both LES-NF and FOUO information, LES-NF supersedes FOUO in the portion 
mark. 
= LES-NF information may be commingled in the same portion with non-LES-NF information (classified or 
unclassified) when appropriate and if the document includes source reference citations in accordance with 
ICD 206, Sourcing Requirements for Disseminated Analytic Products, dated 17 October 2007. 

e |f the commingled portion contains both LES-NF and IC information that is also NOFORN, the “LES” 
marking is used in the portion mark and a NOFORN marking is added to the portion mark (i.e., 
(S//NF//LES). 

e Refer to Section D.2., Table 3 FD&R Markings Precedence Rules for Banner Line Roll-Up for LES 
NOFORN FD&R markings guidance. 

e The LES-NF information must be identified in the source reference citations as endnotes keyed to the 
relevant LES-NF information in the document. 

= — If the document does not include source reference citations in accordance with ICD 206, the LES-NF portions 
must be segregated from all non-LES-NF portions. 


(U) eee 

Agencies that originate LES NOFORN information may choose to disseminate the information which they 
have caveated LES NOFORN by posting on a website, on a classified network, or an unclassified virtual 
private network with proper access controls. However, if the originating agency chooses to disseminate such 
intelligence only on a point-to-point basis, the warning statement will be expanded to include the statement, 
"Recipients are prohibited from subsequently posting the information marked LES NOFORN ona 
website or an unclassified network." 

« Information bearing the LES NOFORN warning statement may not be used in legal proceedings without first 
receiving authorization from the originator. 

= The originating organization may authorize other sharing of LES NOFORN information (for example, with 
victims of a crime) when the specific circumstances justify it. If such request is granted, it is the responsibility 
of the individual who is sharing the information to educate its recipient on how the information must be used 
and protected. 

= Unclassified LES NOFORN information may not be disseminated to foreign nationals without the express 
written permission of the originating agency. 

= Unclassified LES NOFORN information is withheld from public release until approval by the originator. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): 

Derivative classifiers who receive and source LES NOFORN information should carry forward the LES NOFORN 
markings (to include the LES NOFORN warning statement) on the information designated and marked as such. See 
above precedence and commingling rules and Section B, paragraph 3 of this document. 


(U) Warnings and Notices: Documents containing LES NOFORN information must be marked on the first page with the 
following warning statement, “(U) LAW ENFORCEMENT SENSITIVE NOFORN: The information marked (U//LES-NF) 
in this document is the property of (insert agency name here) and may be distributed within the Federal 
Government (and its contractors), US intelligence, law enforcement, public safety or protection officials and 
individuals with a need to know. Distribution beyond these entities without (insert agency name here) 
authorization is prohibited. Precautions should be taken to ensure this information is stored and/or destroyed in 
a manner that precludes unauthorized access. Information bearing the LES NOFORN caveat may not be used in 
legal proceedings without first receiving authorization from the originating agency. Recipients are prohibited 
from subsequently posting the information marked LES NOFORN on a website or an unclassified network.” 
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(U) Notional Example Page 1: 


UNCLASSIFIED//LES NOFORN 
[Insert LES NOFORN Warning] 


(U//LES-NF) This is the portion mark for a portion that is UNCLASSIFIED and contains LES information which is 
not authorized for foreign disclosure or release. This portion is marked for training purposes only. 


(U) This is the portion mark for a portion that is UNCLASSIFIED. This portion is marked for training purposes only. 


UNCLASSIFIED//LES NOFORN 


(U) Notional Example Page 2: 


UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE NOFORN 
[Insert LES NOFORN Warning] 


(U//LES-NF) This is the portion mark for a portion that is UNCLASSIFIED and contains LES information which 
is not authorized for foreign disclosure or release. This portion is marked for training purposes only. 


(U//FOUO) This is the portion mark for a portion that is UNCLASSIFIED and contains FOR OFFICIAL USE 
ONLY information. This portion is marked for training purposes only. 


UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE NOFORN 


(U) Notional Example Page 3: 


SECRET//NOFORN//LES 
[Insert LES NOFORN Warning] 


(S//REL TO USA, FVEY) This is the portion mark for a portion that is classified SECRET AUTHORIZED FOR 
RELEASE TO FVEY (i.e., USA, Australia, Canada, New Zealand and United Kingdom). This portion is marked 
for training purposes only. 


(U//LES-NF) This is the portion mark for a portion that is UNCLASSIFIED and contains LES NOFORN 
information. Because this portion is LES and not authorized for foreign disclosure or release, the banner line 
must contain both the LES and NOFORN markings; however, the IC dissemination control marking NOFORN 
always takes precedence in the banner line. This portion is marked for training purposes only. 


(U) Note: The classification authority block is required on all U.S classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN//LES 
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(U) Notional Example Page 4: 
SECRET//NOFORN//LES 
[Insert LES NOFORN Warning] 


(S//NF) This is the portion mark for a portion that is SECRET and not authorized for foreign disclosure or 
release. This portion is marked for training purposes only. 


(U//LES-NF) This is the portion mark for a portion that is UNCLASSIFIED and contains LES NOFORN 
information. This portion is marked for training purposes only. 


(U) Note: Because both portions are not authorized for foreign disclosure or release, the banner line must 
contain NOFORN. 


(U) Note: The classification authority block is required on all U.S classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN//LES 


(U) Notional Example Page 5: 


SECRET//NOFORN//LES 
[Insert LES NOFORN Warning] 


(S//REL TO USA, GBR) This is the portion mark for a portion that is SECRET and authorized for release to 
United Kingdom (GBR). This portion is marked for training purposes only. 


(U//LES-NF) This is the portion mark for a portion that is UNCLASSIFIED and contains LES NOFORN 
information. This portion is marked for training purposes only. 


(U) Note: Because the second portion is not releasable to foreign nationals and overall the document is 
classified, the banner line must contain NOFORN. 


(U) Note: The classification authority block is required on all U.S classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//NOFORN//LES 
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(U) Note: This marking will be evaluated for continued registration with the 14 November 2016 implementation of 
the Controlled Unclassified Information (CUI) Program. 


(U) Authorized Banner Line Marking 


Title: SENSITIVE SECURITY INFORMATION 


(U) Authorized Banner Line Abbreviation: SSI 


(U) Authorized Portion Mark: SSI 

(U) Example Banner Line: UNCLASSIFIED//SSI 

(U) Example Portion Mark: (U//SSI) 

(U) Marking Sponsor/Policy Basis: DHS/49 USC 114 AND 40119 


(U) Definition: As defined in 49 C.F.R. 15.5 and 1520.5, information (unclassified) obtained or developed in the conduct 
of security activities, including research and development, the disclosure of which Department of Homeland Security 
(DHS)/Transportation Security Administration (TSA) or Department of Transportation (DOT) has determined would (1) 
constitute an unwarranted invasion of privacy (including, but not limited to, information contained in any personnel, 
medical, or similar file); (2) reveal trade secrets or privileged or confidential information obtained from any person; or (3) 
be detrimental to the safety or security of transportation. 


(U) Further Guidance: 
= Homeland Security Act of 2002, Public Law 107-296, 116 Stat. 2135 (2002), as amended 
Aviation and Transportation Security Act, Public Law 107-71, 115 Stat. 597 (2001) 
Maritime Transportation Security Act of 2002, Public Law 107-295, 116 Stat. 2064 (2002), as amended 
49 CFR Parts 15 and 1520, Protection of Sensitive Security Information 
DHS Management Directive 11056.1, Sensitive Security Information 


(U) Applicability: Government (Federal, State, and Local) and private sector entities requiring access to federally-owned 
information pertaining to the conduct of transportation security. DHS and DOT are the primary users that create SSI and 
originally apply this marking. With the coordination of DHS, other federal, state, local, or tribal agencies may use the SSI 
designation to protect transportation security-related information identified in 49 CFR Parts 15 or 1520. 


(U) Additional Marking Instructions: Applicable only to unclassified information. 


(U) Relationship(s) to Other Markings: 
= May be used with TOP SECRET, SECRET, CONFIDENTIAL, or UNCLASSIFIED. 
= May be used with IC FD&R markings; however, the REL TO [USA, LIST] or DISPLAY ONLY [LIST] markings 
should be applied only if the originating agency has authorized release or disclosure of the SSI to countries in the 
[LIST] 


(U) Precedence Rules for Banner Line Guidance: 
= If the SSI marking is contained in any portion of a document it must appear in the banner line, regardless of the 
document’s overall classification level. 
= When a document contains both (U//FOUO) and (U//SSI) portions, SSI takes precedence in the banner line. 
= Refer to Section D. Table 3, FD&R Markings Precedence Rules for Banner Line Roll-Up contains additional 
guidance. 
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(U) commingling Rule(s) Within a Portion: 
When a portion contains both SSI and FOUO information, SSI supersedes FOUO in the portion mark. 
= SSI information may be commingled in the same portion with non-SSI information (classified or unclassified) 
when appropriate and if the document includes source reference citations in accordance with ICD 206, Sourcing 
Requirements for Disseminated Analytic Products, dated 17 October 2007. 
e The SSI marking is conveyed in the portion mark. 
e The SSI information must be identified in the source reference citations as endnotes keyed to the relevant SSI 
information in the document. 


= — If the document does not include source reference citations in accordance with ICD 206, the SSI portions must be 
segregated from all non-SSI portions. 


(U) Notes: 
= Unclassified SSI information is withheld from public release until approved by the originator. 
= SSI is a caveat approved by statute to protect information, the release of which would be detrimental to the safety 


or security of transportation. It has absolute legal protections against public release through a Freedom of 
Information Act (FOIA) request. 


(U) Derivative Use (i.e., re-use of information in whole or in part in intelligence products): 
= While both DHS and DOT have SSI authorities, SSI encountered in the IC generally reflect DHS equities. Direct 


questions regarding foreign release to DHS at SSI@hq.dhs.gov, which will consult with DOT, as required. DOT 
can be contacted directly, at ssi@dot.gov. 


Foreign disclosure and release determinations require prior approval of the originating agency. Until originator 


approval is obtained, mark SSI portions as NOFORN when an FD&R marking is required as described in Section 
B, paragraph 3 of this document. 


(U) Warnings and Notices: Documents containing SSI information must be marked with the following warning statement 
placed at the bottom of each page, “(U) Warning: This record contains Sensitive Security Information that is 
controlled under 49 CFR parts 15 and 1520. No part of this record may be disclosed to persons without a “need- 
to-know,” as defined in 49 CFR parts 15 and 1520, except with the written permission of the Administrator of the 


Transportation Security Administration or the Secretary of Transportation. Unauthorized release may result in 


civil penalty or other action. For U.S. government agencies, public disclosure is governed by 5 USC 552 and 49 
CFR parts 15 and 1520.” 


(U) Notional Example Page 1: 


UNCLASSIFIED//NOFORN//SSI 


(U//INF//SSI) This is the portion mark for a portion that is UNCLASSIFIED, not authorized for foreign disclosure or 
release, and contains SENSITIVE SECURITY INFORMATION. This portion is marked for training purposes only. 


[Insert SSI Warning] 


UNCLASSIFIED//NOFORN//SSI 
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(U) Notional Example Page 2: 


SECRET//REL TO USA, ACGU//SSI 
(S//REL TO USA, ACGU) This is the portion mark for a portion that is classified SECRET and contains SENSITIVE 
SECURITY INFORMATION and authorized for release to ACGU (i.e., USA, Australia, Canada and United 
Kingdom). This portion is marked for training purposes only. 
(S//REL TO USA, ACGU) This is the portion mark for a portion that is classified SECRET and contains SENSITIVE 
SECURITY INFORMATION and authorized for release to ACGU. This portion is marked for training purposes 
only. 
(U//IREL TO USA, ACGU//SSI) This is the portion mark for a portion that is UNCLASSIFIED and contains 


SENSITIVE SECURITY INFORMATION authorized for release to ACGU. This portion is marked for training 
purposes only. 


[Insert SSI Warning] 


(U) Note: The classification authority block is required on all US classified NSI. See the ISOO Implementing 
Directive and General Marking Guidance Section of this document for more information. 


SECRET//REL TO USA, ACGU//SSI 
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(U) Table 8 below provides a list of changes to the banner line syntax since inception of the standard. 


Table 8: (U) History of Banner Line Syntax Changes 


(U) This table is UNCLASSIFIED. 


Removed the requirement mandating that every banner line 
and portion mark reflect an explicit foreign disclosure and 
release determination. ICD 710, Classification Management 
and Control Markings System, dated 21 June 2013, modified 
the foreign disclosure and release marking requirement, 
mandating an explicit FD&R marking only under certain 
circumstances, as specified in §E.5. 


Removed repeating “SAR-” for multiple SAR markings in the 
SAP category. Expanded SAP guidance to include an 
optional, standard program hierarchy. Identified the first “SAR- 
” as the SAP category designator and mirrored SCI 
separators for SAP hierarchical levels. 


Created new Atomic Energy Act information markings 
category in the banner line. The AEA markings in this 
category were previously in the Dissemination Control 
Markings category of the banner and include: RD, -CNWDI, - 
SIGMA, FRD, -SIGMA, DOD UCNI, and DOE UNCI. 


Identified ATOMAL, BOHEMIA, and BALK as NATO control 
markings, not NATO classifications. Modified the title of the 
Non-US Classification Markings category to “Non-US 
Protective Markings” to reflect that the NATO markings 
included in the category are both classification levels and 
control markings. 


Eliminated the Declassification Value category in the Banner 
Line per DD, CAPCO memo, dated 22 January 2008. This 
action: 
Made the Manual Review (MR) marking obsolete - MR 
was never intended or authorized as a marking for the 
“Declassify On” line on documents classified under EO 
13526. Eliminates the need to link a declassification 
value in the banner line to the “Declassify On” line in the 
classification authority block, as required by |ISOO 
Implementing Directive. 
Makes proper use of the “Declassify On” line even more 
critical as this value reflects applicable declassification 
review and exemption information. 


UNCLASSIFIED//rexs*— 


Re-marking of legacy 
information is not required. 


Re-marking of legacy 
information is not required. 
Upon re-use, if possible, the 
markings must be modified to 
reflect the current standard, if 
applicable. SAP program 
hierarchy is optional and 
based on operational need. 


Re-marking of legacy 
information is not required. 
Upon re-use, markings must 
be modified, if possible, to 
reflect the current standard. 


Re-marking of legacy 
information is not required. 
Upon re-use, markings must 
be modified, if possible, to 
reflect the current standard. 


Re-marking of legacy 
information is not required. 


Does not eliminate or rescind 
ISOO’s requirement for a 
“Declassify On” value in the 
classification authority block 
on the first page of each 
classified document, 
regardless of media. 
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October 2003 
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Changed separators from commas to a single forward slash 
for multiple Dissemination Control Markings and Non- 
Intelligence Community Dissemination Control Markings 
categories. For the “REL TO” marking, the lower case “and” 
was eliminated as the indicator for the end of a country code 
and/or tetragraph code list. 


Moved the Special Access Required (SAR) marking from the 
Non-Intelligence Community Dissemination Control Markings 
category to a new category, “Special Access Program 
Markings.” The new category follows the existing SCI Control 
Markings category. 


UNCLASSIFIED//rexs— 


395 


Re-marking of legacy 
information is not required. 
Upon re-use, markings must 
be modified, if possible, to 
reflect the new standard. 


Re-marking of legacy 
documents is not required. 
Upon re-use, markings must 
be modified, if possible, to 
reflect the current standard. 
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J. (U) Marking Examples 
(U) Note: All markings are for training purposes only. 
(U) Basic Example: 
Banner Line: SECRET//REL TO USA, FVEY/RELIDO 


Portion Mark: (S//REL/RELIDO) or (C//REL TO USA, FVEY/RELIDO) 
Note: “REL” is an authorized portion marking abbreviation for the REL TO marking and may be used when the 
portion’s [LIST] matches the REL TO [LIST] in the banner line. 


(U) Multiple SCI Control Systems Example: 


Banner Line: TOP SECRET//SI-GAMMA/TALENT KEYHOLE//RISK SENSITIVE/ 
ORIGINATOR CONTROLLED/NOFORN 


Or abbreviated as: TOP SECRET//SI-G/TK//RSEN/ORCON/NOFORN 
Portion Mark: (TS//SI-G/TK//RS/OC/NF) 
(U) Multiple Notional SCI Compartments Example: 
Banner Line: TOP SECRET//SI-ABC-DEF//ORCON/NOFORN 
Portion Mark: (TS//SI-ABC-DEF//OC/NF) 
(U) Multiple Notional SCI Sub-Compartments Example: 
Banner Line: TOP SECRET//SI-G ABCD EFGH-XYZ//ORCON/NOFORN 
Portion Mark: (TS//SI-G ABCD EFGH-XYZ//OC/NF) 


(U) Multiple Notional Unpublished SCI control systems with AUNPUB (ANB) and XUNPUB (XNB) as mock 
unpublished control systems and SI and TK published control systems Example: 


Banner Line: TOP SECRET//AUNPUB/SI/TALENT KEYHOLE/XUNPUB//NOFORN 
Or abbreviated as: TOP SECRET//ANB/SI/TK/XNB//NOFORN 
Portion Mark: (TS//ANB/SI/TK/XNB//NF) 
(U) Multiple Notional HCS Compartments and Sub-Compartments Example: 
Banner Line: TOP SECRET//HCS-P JJJ-P DDDD//ORCON/NOFORN 


Portion Mark: (TS//HCS-P JJJ-P DDDD//OC/NF) 
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(U) Multiple SCI and Notional SAP Example: 


Banner Line: TOP SECRET//HCS-P/LMN//SPECIAL ACCESS REQUIRED-BUTTER POPCORN// 
NOT RELEASABLE TO FOREIGN NATIONALS 


Or abbreviated as: TOP SECRET//HCS-P/LMN//SAR-BP//NOFORN 
Portion Mark: (TS//HCS-P/LMN//SAR-BP//NF) 
(U) Multiple SAP Notional Example: 
Banner Line: TOP SECRET//SAR-BUTTER POPCORN-123/CANDY APPLE-XYZ YYY//NOFORN 
Or abbreviated as: TOP SECRET//SAR-BP-123/CA-XYZ YYY//NOFORN 
Portion Mark: (TS//SAR-BP-123/CA-XYZ YYY//NF) 
(U) Atomic Energy Act (AEA) Markings Examples: 
Banner Line Example 1: TOP SECRET//RD-CNWDI//NOFORN 
Portion Mark Example 1: (TS//RD-CNWDI//NF) 
Banner Line Example 2: SECRET//FRD-SIGMA 14 18//REL TO USA, ACGU 
Portion Mark Example 2: (S//FRD-SG 14 18//REL) 


Note: “REL” is an authorized portion marking abbreviation for the REL TO marking and may be used when the 
portion’s [LIST] matches the REL TO [LIST] in the banner line. 


(U) Non-US Protective Markings Examples: 
Banner Line Example 1: //COSMIC TOP SECRET//BOHEMIA 
Portion Mark Example 1: (//CTS//BOHEMIA) 
Banner Line Example 2: /DEU SECRET//REL TO USA, DEU 
Portion Mark Example 2: (//DEU S//REL TO USA, DEU) 
Banner Line Example 3: //INATO SECRET//ATOMAL//ORCON 
Portion Mark Example 3: (//NS//ATOMAL//OC) 
(U) JOINT Classification Example: 
Banner Line: //JOINT SECRET CAN GBR USA//REL TO USA, CAN, GBR 


Portion Mark: (//JOINT S//REL) 
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Note: The “JOINT [class level]” and “REL” abbreviations may be used when the portion’s JOINT and REL TO 
[LIST] matches the JOINT and REL TO markings’ [LIST] values in the banner line. 


(U) FGI Examples: 
Banner Line Example 1: TOP SECRET//FGI DEU GBR//REL TO USA, DEU, GBR 
Portion Mark Example 1: (TS//FGI DEU GBR//REL TO USA, DEU, GBR) [Commingled US TS and FGI portion] 
Banner Line Example 2: SECRET//TK//FGI//NOFORN 
Portion Mark Example 2: (//FGI S//NF) 
(U) Dissemination Control Markings Examples: 
Banner Line Example 1: SECRET//REL TO USA, DEU/RELIDO 
Portion Mark Example 1: (S//REL TO USA, DEU/RELIDO) 
Banner Line Example 2: SECRET 
Portion Mark Example 2: (S) 
Banner Line Example 3: SECRET//NOFORN/PROPIN 
Portion Mark Example 3: (S//NF/PR) 
Banner Line Example 4: UNCLASSIFIED//REL TO USA, FVEY 


Portion Mark Example 4: (U//REL TO USA, FVEY) or (U//REL) Note: “REL” is an authorized abbreviation when a 
portion’s [LIST] value(s) matches the banner line [LIST] value(s). 


Banner Line Example 5: UNCLASSIFIED//FOUO/NOFORN) 
Portion Mark Example 5: (U//FOUO/NF) 

(U) Non-IC Dissemination Control Markings Example: 
Banner Line: UNCLASSIFIED//SSI 


Portion Mark: (U//SSI) 
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K. (U) Acronym List 


Atomic Energy Act 


BLUEFISH 
Web Logs 


CONFIDENTIAL 

Controlled Access Program Coordination Office 
Code of Federal Regulations 

Central Intelligence Agency 

Chief Information Officer 

Classified Military Information 

Classification Management Implementation Working Group 
Classification Management Branch 
Classification Management Tools 

Classified National Security Information 

Critical Nuclear Weapon Design Information 
Communications Intelligence 

Concept of Operations 

Change Request 

COSMIC Top Secret 

COSMIC Top Secret ATOMAL 

Controlled Unclassified Information 


Disseminated Analytic Product 
Director of Central Intelligence Directive 


DOD UNCLASSIFIED CONTROLLED NUCLEAR INFORMATION 


Drug Enforcement Agency 
Department of Homeland Security 
Defense Intelligence Agency 
Designated Intelligence Disclosure Official 
Director of National Intelligence 
Department of Defense 
Department of Energy 
Department of State 

Department of Transportation 
LIMDIS 

DEA Sensitive 


Executive Order 

Enterprise Standards Baseline 
ECRU 

Exclusive Distribution 


Federal Bureau of Investigation 
Foreign Disclosure and Release 
Foreign Disclosure and Release Officer 
Foreign Government Information 
Foreign Intelligence Surveillance Act 
Freedom of Information Act 

For Official Use Only 

Formerly Restricted Data 

Gamma 
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GENC 
GEOINT 


HCS 
HUMINT 


LES 
LIMDIS 


Geopolitical Entities, Names, and Codes 
Geospatial Intelligence 


HUMINT Control System 
Human Intelligence 


Information Assurance Division 

In Accordance With 

Intelligence Community 

Intelligence Community Chief Information Officer 


Intelligence Community Information Technology Environment 


Intelligence Community Directive 
Intelligence Community Program Guidance 
Intelligence Community Policy Memorandum 
Intelligence Community Standard 

IDITAROD 

IMCON 

Controlled Imagery 

Information Management Division 

Integrated NRO Classification Guide 
Information Security Markings 

International Organization for Standardization 
Information Security Oversight Office 


Joint Atomic Energy Information Exchange Group 
Joint Worldwide Intelligence Communications System 


KANDIK 
KLONDIKE Control System 
KLONDIKE 


Law Enforcement Sensitive 
Limited Distribution 


Manual Review 


North Atlantic Council 

National Archives and Records Administration 
North Atlantic Treaty Organization 

NATO Confidential 

Confidential ATOMAL 

National Counterintelligence Executive 

National Counterintelligence and Security Center 
NODIS 

National Disclosure Policy 

NOFORN 

National Geospatial-Intelligence Agency 
Non-Classified Internet Protocol Router Network 
NONBOOK 

Naval Nuclear Propulsion Information 

No Distribution 

Not Releasable to Foreign Nationals 

NATO Restricted 

National Reconnaissance Office 

NATO Secret 


UNCLASSIFIED//rexs*— 


198 


400 


401 


ORCON 


ORCON-USGOV Originator Controlled - US Government (Executive Branch Departments and Agencies) 


OUSD(I) 


SIPRNet 
SISR 
SLTT 
SMP 
SNM 
SPECAT 
SSD 

SSI 


TFNI 
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National Security Agency 

Secret ATOMAL 

National System for Geospatial Intelligence 
National Security Information 
Need-To-Know 

NATO Unclassified 


Operations 

Originating Agency’s Determination Required 
ORCON 

Original Classification Authority 

Office of the Director of National Intelligence 
Office of the General Council 

Office of Legislative Affairs 

Originator Controlled 


Office of the Under Secretary of Defense for Intelligence 


Production 

Policy and Strategy 

Principal Deputy Director, National Intelligence 
Partner Engagement 

PROPIN 

Proprietary Information 


Restricted Data 

REL TO 

Authorized for Release To 

Releasable by Information Disclosure Official 
RESERVE 

RSEN 

Risk Sensitive 


SECRET 

Special Access Program 

Special Access Required 

Sensitive Analytical Techniques 
Sensitive Analytical Techniques Panel 
Sensitive But Unclassified 

Sensitive Compartmented Information 
Secure Communities Of Interest 

Senior Foreign Disclosure and Release Authority 
SIGMA 

Special Intelligence 

Signals Intelligence 

Secret Internet Protocol Router Network 
Signals Intelligence Security Regulations 
State, Local, Tribal, and Territorial 
Security Markings Program 

Special Nuclear Material 

Special Category 

Special Security Directorate 

Special Security Information 


Transclassified Foreign Nuclear Information 
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Talent Keyhole 
TOP SECRET 
Transportation Security Administration 


UNCLASSIFIED 

Unclassified Controlled Nuclear Information 
Uniform Resource Locator 

Under Secretary of Defense for Intelligence 
United States Government 


Weapons of Mass Destruction 


EXDIS 
Extensible Markup Language 
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instruction at the address listed below. 


MICHAEL V. HAYDEN 
Lieutenant General, USAF 


NSTISSC Secretariat (142). National Security Agency.9800 Savage Road STE 6716. Ft Meade MD 20755-6716 
(410) 854-6805.UFAX: (410) 854-6814 
nstissc @radium.ncsc.mil 


UNCLASSIFIED 


405 


Al 


access 


access control 


access control list (ACL) 


access control mechanism 


access control officer (ACO) 


access level 


access list 


access period 


406 


SECTION | 


TERMS AND DEFINITIONS 


Highest level of trust defined in the Orange Book 
(Department of Defense Trusted Computer System 
Evaluation Criteria, DoD 5200.28-STD). 


Opportunity to make use of an information system 
(IS) resource. 


Limiting access to information system resources 
only to authorized users, programs, processes, or 
other systems. 


Mechanism implementing discretionary and/or 
mandatory access control between subjects and 
objects. 


Security safeguard designed to detect and deny 
unauthorized access and permit authorized access 
in an IS. 


Designated individual responsible for limiting 
access to information systems resources. 


Hierarchical portion of the security level used to 
identify the sensitivity of IS data and the clearance 
or authorization of users. Access level, in 
conjunction with the nonhierarchical categories, 
forms the sensitivity label of an object. See 
category. 


(IS) Compilation of users, programs, or processes 
and the access levels and types to which each is 
authorized. 


(COMSEC) Roster of persons authorized 
admittance to a controlled area. 


Segment of time, generally expressed in days or 
weeks, during which access rights prevail. 


406 


access profile 


access type 


accountability 


accounting legend code (ALC) 


accounting number 


accreditation 


accreditation package 


accrediting authority 
add-on security 


advisory 
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Associates each user with a list of protected objects 
the user may access. 


Privilege to perform action on an object. Read, 
write, execute, append, modify, delete, and create 
are examples of access types. 


(IS) Process of tracing IS activities to a responsible 
source. 


(COMSEC) Principle that an individual is entrusted 
to safeguard and control equipment, keying 
material, and information and is answerable to 
proper authority for the loss or misuse of that 
equipment or information. 


Numeric code used to indicate the minimum 
accounting controls required for items of 
accountable COMSEC material within the 
COMSEC Material Control System. 


Number assigned to an item of COMSEC material 
to facilitate its control. 


Formal declaration by a Designated Approving 
Authority (DAA) that an IS is approved to operate 
in a particular security mode at an acceptable level 
of risk, based on the implementation of an 
approved set of technical, managerial, and 
procedural safeguards. 


Product comprised of a System Security Plan (SSP) 
and a report documenting the basis for the 
accreditation decision. 


Synonymous with Designated Approving Authority 
(DAA). 


Incorporation of new hardware, software, or 
firmware safeguards in an operational IS. 


Notification of significant new trends or 
developments regarding the threat to the IS of an 
organization. This notification may include 
analytical insights into trends, intentions, 
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alert 


alternate COMSEC custodian 


anti-jam 


anti-spoof 


assembly 


assurance 


attack 


attention character 


audit 


audit trail 
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technologies, or tactics of an adversary targeting 
ISs. 


Notification that a specific attack has been directed 
at the IS of an organization. 


Person designated by proper authority to perform 
the duties of the COMSEC custodian during the 
temporary absence of the COMSEC custodian. 


Measures ensuring that transmitted information 
can be received despite deliberate jamming 
attempts. 


Measures preventing an opponent’s participation 
in an IS. 


Group of parts, elements, subassemblies, or 
circuits that are removable items of COMSEC 
equipment. 


See information assurance. 


Type of incident involving the intentional act of 
attempting to bypass one or more security controls 
(see Information Assurance) of an IS. 


In Trusted Computing Base (TCB) design, a 
character entered from a terminal that tells the 
TCB the user wants a secure communications path 
from the terminal to some trusted code to provide a 
secure service for the user. 


Independent review and examination of records 
and activities to assess the adequacy of system 
controls, to ensure compliance with established 
policies and operational procedures, and to 
recommend necessary changes in controls, 
policies, or procedures. 


Chronological record of system activities to enable 
the reconstruction and examination of the 
sequence of events and/or changes in an event. 
Audit trail may apply to information in an IS, to 
message routing in a communications system, or 
to the transfer of COMSEC material. 
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authenticate 


authentication 


authentication system 


authenticator 
authorization 


authorized vendor 


Authorized Vendor Program 
(AVP) 


automated security monitoring 


automatic remote rekeying 


availability 
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To verify the identity of a user, user device, or 
other entity, or the integrity of data stored, 
transmitted, or otherwise exposed to unauthorized 
modification in an IS, or to establish the validity of 
a transmission. 


Security measure designed to establish the validity 
of a transmission, message, or originator, or a 
means of verifying an individual’s authorization to 
receive specific categories of information. 


Cryptosystem or process used for authentication. 


Means used to confirm the identity of a station, 
originator, or individual. 


Access privileges granted to a user, program, or 
process. 


Manufacturer of INFOSEC equipment authorized to 
produce quantities in excess of contractual 
requirements for direct sale to eligible buyers. 
Eligible buyers are typically U.S. Government 
organizations or U.S. Government contractors. 


Program in which a vendor, producing an 
INFOSEC product under contract to NSA, is 
authorized to produce that product in numbers 
exceeding the contracted requirements for direct 
marketing and sale to eligible buyers. Eligible 
buyers are typically U.S. Government organizations 
or U.S. Government contractors. Products 
approved for marketing and sale through the AVP 
are placed on the Endorsed Cryptographic 
Products List (ECPL). 


Use of automated procedures to ensure security 
controls are not circumvented or the use of these 
tools to track actions taken by subjects suspected 
of misusing the IS. 


Procedure to rekey a distant crypto-equipment 
electronically without specific actions by the 
receiving terminal operator. 


Timely, reliable access to data and information 
services for authorized users. 
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back door 


backup 


banner 


Bell-La Padula security model 


benign 


benign environment 


beyond Al 


binding 


biometrics 


bit error rate 
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Hidden software or hardware mechanism used to 
circumvent security controls. Synonymous with 
trap door. 


Copy of files and programs made to facilitate 
recovery, if necessary. 


Display on an IS that sets parameters for system 
or data use. 


Formal-state transition model of a computer 
security policy that describes a formal set of access 
controls based on information sensitivity and 
subject authorizations. See star (*) property and 


simple security property. 


Condition of cryptographic data that cannot be 
compromised by human access. 


Nonhostile environment that may be protected 
from external hostile elements by physical, 
personnel, and procedural security 
countermeasures. 


Level of trust defined by the DoD Trusted 
Computer System Evaluation Criteria (TCSEC) to 
be beyond the state-of-the-art technology. It 
includes all the Al-level features plus additional 
ones not required at the Al-level. 


Process of associating a specific communications 
terminal with a specific cryptographic key or 
associating two related elements of information. 


Automated methods of authenticating or verifying 
an individual based upon a physical or behavioral 
characteristic. 


Ratio between the number of bits incorrectly 
received and the total number of bits transmitted 
in a telecommunications system. 


Designation applied to information systems, and to 
associated areas, circuits, components, and 
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boundary 
brevity list 


browsing 


bulk encryption 


C 


call back 


canister 


capability 


cascading 


category 


CCI assembly 
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equipment, in which national security information 
is encrypted or is not processed. 


Software, hardware, or physical barrier that limits 
access to a system or part of a system. 


List containing words and phrases used to shorten 
messages. 


Act of searching through IS storage to locate or 
acquire information, without necessarily knowing 
the existence or format of information being 
sought. 


Simultaneous encryption of all channels of a 
multichannel telecommunications link. 


Procedure for identifying and authenticating a 
remote IS terminal, whereby the host system 
disconnects the terminal and reestablishes 
contact. Synonymous with dial back. 


Type of protective package used to contain and 
dispense key in punched or printed tape form. 


Protected identifier that both identifies the object 
and specifies the access rights to be allowed to the 
subject who possesses the capability. In a 
capability-based system, access to protected 
objects such as files is granted if the would-be 
subject possesses a capability for the object. 


Downward flow of information through a range of 
security levels greater than the accreditation range 
of a system network or component. 


Restrictive label applied to classified or unclassified 
information to limit access. 


Device embodying a cryptographic logic or other 
COMSEC design that NSA has approved as a 
Controlled Cryptographic Item (CCI). It performs 
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CCI component 


CCI equipment 


central office of record 
(COR) 


certificate 


certificate management 


certificate revocation list 
(CRL) 


certification 


certification authority (CA) 


certification authority 
workstation (CAW) 


NSTISSI No. 4009 


UNCLASSIFIED 


the entire COMSEC function, but depends upon 
the host equipment to operate. 


Part of a Controlled Cryptographic Item (CCI) that 

does not perform the entire COMSEC function but 
depends upon the host equipment, or assembly, to 
complete and operate the COMSEC function. 


Telecommunications or information handling 
equipment that embodies a Controlled 
Cryptographic Item (CCI) component or CCI 
assembly and performs the entire COMSEC 
function without dependence on host equipment to 
operate. 


Office of a federal department or agency that keeps 
records of accountable COMSEC material held by 
elements subject to its oversight. 


Record holding security information about an IS 
user and vouches to the truth and accuracy of the 
information it contains. 


Process whereby certificates (as defined above) are 
generated, stored, protected, transferred, loaded, 
used, and destroyed. 


List of invalid certificates (as defined above) that 
have been revoked by the issuer. 


Comprehensive evaluation of the technical and 
nontechnical security safeguards of an IS to 
support the accreditation process that establishes 
the extent to which a particular design and 
implementation meets a set of specified security 
requirements. 


Third level of the Public Key Infrastructure (PKI) 
Certification Management Authority responsible for 
issuing and revoking user certificates, and exacting 
compliance to the PKI policy as defined by the 
parent Policy Creation Authority (PCA). 


Commercial-off-the-shelf (COTS) workstation with 
a trusted operating system and special purpose 
application software that is used to issue 
certificates. 
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4B 


certification package 


certification test and 
evaluation (CT&E) 


certified TEMPEST technical 
authority (CTTA) 


certifier 


challenge and reply 
authentication 


checksum 


check word 


cipher 


cipher text 


cipher text auto-key 
(CTAK) 


ciphony 


classified information 
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Product of the certification effort documenting the 
detailed results of the certification activities. 


Software and hardware security tests conducted 
during development of an IS. 


An experienced, technically qualified U.S. 
Government employee who has met established 
certification requirements in accordance with 
NSTISSC-approved criteria and has been appointed 
by a U.S. Government Department or Agency to 
fulfill CTTA responsibilities. 


Individual responsible for making a technical 
judgment of the system’s compliance with stated 
requirements, identifying and assessing the risks 
associated with operating the system, coordinating 
the certification activities, and consolidating the 
final certification and accreditation packages. 


Prearranged procedure in which a subject requests 
authentication of another and the latter 
establishes validity with a correct reply. 


Value computed on data to detect error or 
manipulation during transmission. See hash total. 


Cipher text generated by cryptographic logic to 
detect failures in cryptography. 


Any cryptographic system in which arbitrary 
symbols or groups of symbols, represent units of 
plain text, or in which units of plain text are 
rearranged, or both. 


Enciphered information. 


Cryptographic logic that uses previous cipher text 
to generate a key stream. 


Process of enciphering audio information, resulting 
in encrypted speech. 


Information that has been determined pursuant to 

Executive Order 12958 or any predecessor Order, 

or by the Atomic Energy Act of 1954, as amended, 
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clearing 


closed security environment 


code 


code book 


code group 


code vocabulary 


cold start 


command authority 
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to require protection against unauthorized 
disclosure and is marked to indicate its classified 
status. 


Removal of data from an IS, its storage devices, 
and other peripheral devices with storage capacity, 
in such a way that the data may not be 
reconstructed using common system capabilities 
(i.e., keyboard strokes); however, the data may be 
reconstructed using laboratory methods. Cleared 
media may be reused at the same classification 
level or at a higher level. Overwriting is one method 
of clearing. 


Environment providing sufficient assurance that 
applications and equipment are protected against 
the introduction of malicious logic during an IS life 
cycle. Closed security is based upon a system’s 
developers, operators, and maintenance personnel 
having sufficient clearances, authorization, and 
configuration control. 


(COMSEC) System of communication in which 
arbitrary groups of letters, numbers, or symbols 
represent units of plain text of varying length. 


Document containing plain text and code 
equivalents in a systematic arrangement, or a 
technique of machine encryption using a word 
substitution technique. 


Group of letters, numbers, or both in a code 
system used to represent a plain text word, phrase, 
or sentence. 


Set of plain text words, numerals, phrases, or 
sentences for which code equivalents are assigned 
in a code system. 


Procedure for initially keying crypto-equipment. 


Individual responsible for the appointment of user 
representatives for a department, agency, or 
organization and their key ordering privileges. 


UNCLASSIFIED 
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Commercial COMSEC 
Endorsement Program (CCEP) 


common criteria 


common fill device 


communications cover 


communications deception 


communications profile 


communications security 
(COMSEC) 


compartmentalization 


45 


NSTISSI No. 4009 


UNCLASSIFIED 


Relationship between NSA and industry in which 
NSA provides the COMSEC expertise (i.e., 
standards, algorithms, evaluations, and guidance) 
and industry provides design, development, and 
production capabilities to produce a type 1 or type 
2 product. Products developed under the CCEP 
may include modules, subsystems, equipment, 
systems, and ancillary devices. 


Provides a comprehensive, rigorous method for 
specifying security function and assurance 
requirements for products and systems. 
(Information Technology Security Evaluation 
Criteria [ITSEC]) 


One of a family of devices developed to read-in, 
transfer, or store key. 


Concealing or altering of characteristic 
communications patterns to hide information that 
could be of value to an adversary. 


Deliberate transmission, retransmission, or 
alteration of communications to mislead an 
adversary’s interpretation of the communications. 
See imitative communications deception and 
manipulative communications deception. 


Analytic model of communications associated with 
an organization or activity. The model is prepared 
from a systematic examination of communications 
content and patterns, the functions they reflect, 
and the communications security measures 
applied. 


Measures and controls taken to deny unauthorized 
persons information derived from 
telecommunications and to ensure the authenticity 
of such telecommunications. Communications 
security includes cryptosecurity, transmission 
security, emission security, and physical security 
of COMSEC material. 


A nonhierarchical grouping of sensitive information 
used to control access to data more finely than 
with hierarchical security classification alone. 
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compartmented mode 


compromise 


compromising emanations 


computer abuse 


computer cryptography 


computer security 


computer security incident 


computer security subsystem 


COMSEC account 


COMSEC account audit 
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INFOSEC mode of operation wherein each user 
with direct or indirect access to a system, its 
peripherals, remote terminals, or remote hosts has 
all of the following: (a) valid security clearance for 
the most restricted information processed in the 
system; (b) formal access approval and signed 
nondisclosure agreements for that information 
which a user is to have access; and (c) valid need- 
to-know for information which a user is to have 
access. 


Type of incident where information is disclosed to 
unauthorized persons or a violation of the security 
policy of a system in which unauthorized 
intentional or unintentional disclosure, 
modification, destruction, or loss of an object may 
have occurred. 


Unintentional signals that, if intercepted and 
analyzed, would disclose the information 
transmitted, received, handled, or otherwise 
processed by information systems equipment. See 
TEMPEST. 


Intentional or reckless misuse, alteration, 
disruption, or destruction of information 
processing resources. 


Use of a crypto-algorithm program by a computer 
to authenticate or encrypt/decrypt information. 


Measures and controls that ensure confidentiality, 
integrity, and availability of IS assets including 
hardware, software, firmware, and information 
being processed, stored, and communicated. 


See incident. 


Hardware/software designed to provide computer 
security features in a larger system environment. 


Administrative entity, identified by an account 
number, used to maintain accountability, custody, 
and control of COMSEC material. 


Examination of the holdings, records, and 
procedures of a COMSEC account ensuring all 
11 


UNCLASSIFIED 


416 


COMSEC aid 


COMSEC boundary 


COMSEC chip set 


COMSEC control program 


COMSEC custodian 


COMSEC end-item 


COMSEC equipment 


COMSEC facility 
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accountable COMSEC material is properly handled 
and safeguarded. 


COMSEC material that assists in securing 
telecommunications and is required in the 
production, operation, or maintenance of COMSEC 
systems and their components. COMSEC keying 
material, callsign/frequency systems, and 
supporting documentation, such as operating and 
maintenance manuals, are examples of COMSEC 
aids. 


Definable perimeter encompassing all hardware, 
firmware, and software components performing 
critical COMSEC functions, such as key generation 
and key handling and storage. 


Collection of NSA approved microchips. 


Computer instructions or routines controlling or 
affecting the externally performed functions of key 
generation, key distribution, message 
encryption/decryption, or authentication. 


Person designated by proper authority to be 
responsible for the receipt, transfer, accounting, 
safeguarding, and destruction of COMSEC material 
assigned to a COMSEC account. 


Equipment or combination of components ready 
for use in a COMSEC application. 


Equipment designed to provide security to 
telecommunications by converting information to a 
form unintelligible to an unauthorized interceptor 
and, subsequently, by reconverting such 
information to its original form for authorized 
recipients; also, equipment designed specifically to 
aid in, or as an essential element of, the conversion 
process. COMSEC equipment includes crypto- 
equipment, crypto-ancillary equipment, 
cryptoproduction equipment, and authentication 
equipment. 


Space used for generating, storing, repairing, or 
using COMSEC material. 
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COMSEC incident 


COMSEC insecurity 


COMSEC manager 


COMSEC material 


COMSEC Material 
Control System (CMCS) 


COMSEC modification 


COMSEC module 


COMSEC monitoring 


COMSEC profile 


COMSEC survey 
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See incident. 


COMSEC incident that has been investigated, 
evaluated, and determined to jeopardize the 
security of COMSEC material or the secure 
transmission of information. 


Person who manages the COMSEC resources of an 
organization. 


Item designed to secure or authenticate 
telecommunications. COMSEC material includes, 
but is not limited to key, equipment, devices, 
documents, firmware, or software that embodies or 
describes cryptographic logic and other items that 
perform COMSEC functions. 


Logistics and accounting system through which 
COMSEC material marked "CRYPTO" is 
distributed, controlled, and safeguarded. Included 
are the COMSEC central offices of record, 
cryptologistic depots, and COMSEC accounts. 
COMSEC material other than key may be handled 
through the CMCS. 


See information systems security equipment 
modification. 


Removable component that performs COMSEC 
functions in a telecommunications equipment or 
system. 


Act of listening to, copying, or recording 
transmissions of one’s own official 
telecommunications to analyze the degree of 
security. 


Statement of COMSEC measures and materials 
used to protect a given operation, system, or 
organization. 


Organized collection of COMSEC and 
communications information relative to a given 
operation, system, or organization. 
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COMSEC system data 


COMSEC training 


concept of operations (CONOP) 
confidentiality 


configuration control 


configuration management 


confinement channel 
confinement property 


contamination 


contingency key 


contingency plan 


controlled access protection 
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Information required by a COMSEC equipment or 
system to enable it to properly handle and control 
key. 


Teaching of skills relating to COMSEC accounting, 
use of COMSEC aids, or installation, use, 
maintenance, and repair of COMSEC equipment. 


Document detailing the method, act, process, or 
effect of using an IS. 


Assurance that information is not disclosed to 
unauthorized persons, processes, or devices. 


Process of controlling modifications to hardware, 

firmware, software, and documentation to ensure 
the IS is protected against improper modifications 
prior to, during, and after system implementation. 


Management of security features and assurances 
through control of changes made to hardware, 
software, firmware, documentation, test, test 
fixtures, and test documentation throughout the 
life cycle of an IS. 


See covert channel. 
Synonymous with star (*) property. 


Type of incident involving the introduction of data 
of one security classification or security category 
into data of a lower security classification or 
different security category. 


Key held for use under specific operational 
conditions or in support of specific contingency 
plans. 


Plan maintained for emergency response, backup 
operations, and post-disaster recovery for an IS, to 
ensure the availability of critical resources and to 
facilitate the continuity of operations in an 
emergency situation. 


The C2 level of protection described in the Trusted 
Computer System Evaluation Criteria (Orange 
Book). Its major characteristics are: individual 
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420 


controlled cryptographic item 
(CCI) 


controlled security mode 


controlled sharing 


controlled space 


controlling authority 


cooperative key generation 


cooperative remote rekeying 


correctness proof 


countermeasure 


covert channel 


covert channel analysis 
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accountability, audit, access control, and object 
reuse. 


Secure telecommunications or information 
handling equipment, or associated cryptographic 
component, that is unclassified but governed by a 
special set of control requirements. Such items are 
marked "CONTROLLED CRYPTOGRAPHIC ITEM" 
or, where space is limited, "CCI." 


See multilevel security. 


Condition existing when access control is applied 
to all users and components of an IS. 


Three-dimensional space surrounding IS 
equipment, within which unauthorized persons are 
denied unrestricted access and are either escorted 
by authorized persons or are under continuous 
physical or electronic surveillance. 


Official responsible for directing the operation of a 
cryptonet and for managing the operational use 
and control of keying material assigned to the 
cryptonet. 


Electronically exchanging functions of locally 
generated, random components, from which both 
terminals of a secure circuit construct traffic 
encryption key or key encryption key for use on 
that circuit. 


Synonymous with manual remote rekeying. 


A mathematical proof of consistency between a 
specification and its implementation. 


Action, device, procedure, technique, or other 
measure that reduces the vulnerability of an IS. 


Unintended and/or unauthorized communications 
path that can be used to transfer information in a 
manner that violates an IS security policy. See 
overt channel and exploitable channel. 


Determination of the extent to which the security 
policy model and subsequent lower-level program 
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covert storage channel 


covert timing channel 


credentials 


critical infrastructures 


cryptanalysis 


CRYPTO 


crypto-alarm 


crypto-algorithm 
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descriptions may allow unauthorized access to 
information. 


Covert channel involving the direct or indirect 
writing to a storage location by one process and 
the direct or indirect reading of the storage location 
by another process. Covert storage channels 
typically involve a finite resource (e.g., sectors on a 
disk) that is shared by two subjects at different 
security levels. 


Covert channel in which one process signals 
information to another process by modulating its 
own use of system resources (e.g., central 
processing unit time) in such a way that this 
manipulation affects the real response time 
observed by the second process. 


Information, passed from one entity to another, 
used to establish the sending entity’s access rights. 


Those physical and cyber-based systems essential 
to the minimum operations of the economy and 
government. 


Operations performed in converting encrypted 
messages to plain text without initial knowledge of 
the crypto-algorithm and/or key employed in the 
encryption. 


Marking or designator identifying COMSEC keying 
material used to secure or authenticate 
telecommunications carrying classified or sensitive 
U.S. Government or U.S. Government-derived 
information. 


Circuit or device that detects failures or 
aberrations in the logic or operation of crypto- 
equipment. Crypto-alarm may inhibit 
transmission or may provide a visible and/or 
audible alarm. 


Well-defined procedure or sequence of rules or 
steps, or a series of mathematical equations used 
to describe cryptographic processes such as 
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crypto-ancillary equipment 


crypto-equipment 
cryptographic 


cryptographic component 


cryptographic equipment room 
(CER) 


cryptographic initialization 


cryptographic logic 


cryptographic randomization 


cryptography 


crypto-ignition key (CIK) 


cryptology 


cryptonet 


cryptoperiod 
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encryption/decryption, key generation, 
authentication, signatures, etc. 


Equipment designed specifically to facilitate 
efficient or reliable operation of crypto-equipment, 
without performing cryptographic functions itself. 


Equipment that embodies a cryptographic logic. 
Pertaining to, or concerned with, cryptography. 


Hardware or firmware embodiment of the 
cryptographic logic. A cryptographic component 
may be a modular assembly, a printed wiring 
assembly, a microcircuit, or a combination of these 
items. 


Controlled-access room in which cryptosystems are 
located. 


Function used to set the state of a cryptographic 
logic prior to key generation, encryption, or other 
operating mode. 


The embodiment of one (or more) crypto- 
algorithm(s) along with alarms, checks, and other 
processes essential to effective and secure 
performance of the cryptographic process(es). 


Function that randomly determines the transmit 
state of a cryptographic logic. 


Art or science concerning the principles, means, 
and methods for rendering plain information 
unintelligible and for restoring encrypted 
information to intelligible form. 


Device or electronic key used to unlock the secure 
mode of crypto-equipment. 


Field encompassing both cryptography and 
cryptanalysis. 


Stations holding a common key. 


Time span during which each key setting remains 
in effect. 
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cryptosecurity 


cryptosynchronization 


cryptosystem 


cryptosystem analysis 


cryptosystem evaluation 


cryptosystem review 


cryptosystem survey 


cyclic redundancy check 


D 


dangling threat 


dangling vulnerability 
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Component of COMSEC resulting from the 
provision of technically sound cryptosystems and 
their proper use. 


Process by which a receiving decrypting 
cryptographic logic attains the same internal state 
as the transmitting encrypting logic. 


Associated INFOSEC items interacting to provide a 
single means of encryption or decryption. 


Process of establishing the exploitability of a 
cryptosystem, normally by reviewing transmitted 
traffic protected or secured by the system under 
study. 


Process of determining vulnerabilities of a 
cryptosystem. 


Examination of a cryptosystem by the controlling 
authority ensuring its adequacy of design and 
content, continued need, and proper distribution. 


Management technique in which actual holders of 
a cryptosystem express opinions on the system’s 
suitability and provide usage information for 
technical evaluations. 


Error checking mechanism that checks data 
integrity by computing a polynomial algorithm 
based checksum. 


Set of properties about the external environment 
for which there is no corresponding vulnerability 
and therefore no implied risk. 


Set of properties about the internal environment 
for which there is no corresponding threat and, 
therefore, no implied risk. 
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data aggregation 


data encryption standard (DES) 


data flow control 


data integrity 


data origin authentication 


data security 


data transfer device (DTD) 


decertification 
decipher 


decode 


decrypt 


dedicated mode 
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The compilation of unclassified individual data 
systems and data elements resulting in the totality 
of the information being classified. 


Cryptographic algorithm, designed for the 
protection of unclassified data and published by 
the National Institute of Standards and Technology 
(NIST) in Federal Information Processing Standard 
(FIPS) Publication 46. 


Synonymous with information flow control. 


Condition existing when data is unchanged from 
its source and has not been accidentally or 
maliciously modified, altered, or destroyed. 


Corroborating the source of data is as claimed. 


Protection of data from unauthorized (accidental or 
intentional) modification, destruction, or 
disclosure. 


Fill device designed to securely store, transport, 
and transfer electronically both COMSEC and 
TRANSEC key, designed to be backward 
compatible with the previous generation of 
COMSEC common fill devices, and programmable 
to support modern mission systems. 


Revocation of the certification of an IS item or 
equipment for cause. 


Convert enciphered text to plain text by means of a 
cryptographic system. 


Convert encoded text to plain text by means of a 
code. 


Generic term encompassing decode and decipher. 


IS security mode of operation wherein each user, 
with direct or indirect access to the system, its 
peripherals, remote terminals, or remote hosts, has 
all of the following: a. valid security clearance for 
all information within the system; b. formal 
access approval and signed nondisclosure 
agreements for all the information stored and/or 
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default classification 


degaussing 


delegated development program 


denial of service 


depot maintenance 


descriptive top-level specification 


design controlled spare part 
(DCSP) (C.F.D.) 


design documentation 
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processed (including all compartments, 
subcompartments, and/or special access 
programs); and c. valid need-to-know for all 
information contained within the IS. When in the 
dedicated security mode, a system is specifically 
and exclusively dedicated to and controlled for the 
processing of one particular type or classification of 
information, either for full-time operation or for a 
specified period of time. 


Temporary classification reflecting the highest 
classification being processed in an IS. Default 
classification is included in the caution statement 
affixed to an object. 


Procedure that reduces the magnetic flux to virtual 
zero by applying a reverse magnetizing field. Also 
called demagnetizing. 


INFOSEC program in which the Director, NSA, 
delegates, on a case by case basis, the development 
and/or production of an entire telecommunications 
product, including the INFOSEC portion, to a lead 
department or agency. 


Type of incident resulting from any action or series 
of actions that prevents any part of an IS from 
functioning. 


See full maintenance. 


Top-level specification written in a natural 
language (e.g., English), an informal design 
notation, or a combination of the two. Descriptive 
top-level specification, required for a class B2 and 
B3 (as defined in the Orange Book, Department of 
Defense Trusted Computer System Evaluation 
Criteria, DoD 5200.28-STD) information system, 
completely and accurately describes a trusted 
computing base. See formal top-level specification. 


Part or subassembly for a COMSEC equipment or 
device with an NSA controlled design. 


Set of documents, required for Trusted Computer 
System Evaluation Criteria (TCSEC) classes C1 
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designated approving authority 
(DAA) 


dial back 


digital signature 


digital signature algorithm 


direct shipment 


discretionary access control 
(DAC) 


distinguished name 


DoD Trusted Computer System 
Evaluation Criteria (TCSEC) 
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and above (as defined in the Orange Book, 
Department of Defense Trusted Computer System 
Evaluation Criteria, DoD 5200.28-STD), whose 
primary purpose is to define and describe the 
properties of a system. As it relates to TCSEC, 
design documentation provides an explanation of 
how the security policy of a system is translated 
into a technical solution via the Trusted 
Computing Base (TCB) hardware, software, and 
firmware. 


Official with the authority to formally assume 
responsibility for operating a system at an 
acceptable level of risk. This term is synonymous 
with designated accrediting authority and 
delegated accrediting authority. 


Synonymous with call back. 


Cryptographic process used to assure message 
originator authenticity, integrity, and 
nonrepudiation. 


Procedure that appends data to, or performs a 
cryptographic transformation of, a data unit. The 
appended data or cryptographic transformation 
allows reception of the data unit and protects 
against forgery, e.g., by the recipient. 


Shipment of COMSEC material directly from NSA 
to user COMSEC accounts. 


Means of restricting access to objects based on the 
identity and need-to-know of users and/or groups 
to which the object belongs. Controls are 
discretionary in the sense that a subject with a 
certain access permission is capable of passing 
that permission (directly or indirectly) to any other 
subject. See mandatory access control. 


Globally unique identifier representing an 
individual’s identity. 


Document containing basic requirements and 
evaluation classes for assessing degrees of 
effectiveness of hardware and software security 
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domain 


dominate 


drop accountability 


electronically generated key 


Electronic Key Management 
System (EKMS) 


electronic messaging services 
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controls built into an IS. This document, DoD 
5200.28 STD, is frequently referred to as the 
Orange Book. 


Unique context (e.g., access control parameters) in 
which a program is operating; in effect, the set of 
objects a subject has the privilege to access. 


Term used to compare IS security levels. Security 
level S1 is said to dominate security level S2, if the 
hierarchical classification of S1 is greater than, or 
equal to, that of S2 and the non-hierarchical 
categories of S1 include all those of S2 as a subset. 


Procedure under which a COMSEC account 
custodian initially receipts for COMSEC material, 
and then provides no further accounting for it to 
its central office of record. Local accountability of 
the COMSEC material may continue to be 
required. See accounting legend code. 


Key generated in a COMSEC device by introducing 
(either mechanically or electronically) a seed key 
into the device and then using the seed, together 
with a software algorithm stored in the device, to 
produce the desired key. 


Interoperable collection of systems being developed 
by services and agencies of the U.S. Government to 
automate the planning, ordering, generating, 
distributing, storing, filling, using, and destroying 
of electronic key and management of other types of 
COMSEC material. 


Services providing interpersonal messaging 
capability; meeting specific functional, 
management, and technical requirements; and 
yielding a business-quality electronic mail service 
suitable for the conduct of official government 
business. 
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428 


electronic security 
(ELSEC) 


element 


embedded computer 


embedded cryptography 


embedded cryptographic system 


emissions security 
(EMSEC) 


encipher 


encode 


encrypt 


encryption algorithm 


end-item accounting 


end-to-end encryption 


end-to-end security 
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Protection resulting from measures designed to 
deny unauthorized persons information derived 
from the interception and analysis of 
noncommunications electromagnetic radiations. 


Removable item of COMSEC equipment, assembly, 
or subassembly; normally consisting of a single 
piece or group of replaceable parts. 


Computer system that is an integral part of a 
larger system. 


Cryptography engineered into an equipment or 
system whose basic function is not cryptographic. 


Cryptosystem performing or controlling a function 
as an integral element of a larger system or 
subsystem. 


Protection resulting from measures taken to deny 
unauthorized persons information derived from 
intercept and analysis of compromising 
emanations from crypto-equipment or an IS. 


Convert plain text to cipher text by means of a 
cryptographic system. 


Convert plain text to cipher text by means of a 
code. 


Generic term encompassing encipher and encode. 


Set of mathematically expressed rules for rendering 
data unintelligible by executing a series of 
conversions controlled by a key. 


Accounting for all the accountable components of a 
COMSEC equipment configuration by a single 
short title. 


Encryption of information at its origin and 
decryption at its intended destination without 
intermediate decryption. 


Safeguarding information in an IS from point of 
origin to point of destination. 
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endorsed for unclassified 
cryptographic item (EUCI) 


endorsement 
entrapment 


environment 


erasure 


Evaluated Products List (EPL) 


event 


executive state 


exercise key 


exploitable channel 
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Unclassified cryptographic equipment that 
embodies a U.S. Government classified 
cryptographic logic and is endorsed by NSA for the 
protection of national security information. See 
type 2 product. 


NSA approval of a commercially developed product 
for safeguarding national security information. 


Deliberate planting of apparent flaws in an IS for 
the purpose of detecting attempted penetrations. 


Aggregate of external procedures, conditions, and 
objects affecting the development, operation, and 
maintenance of an IS. 


Process intended to render magnetically stored 
information irretrievable by normal means. 


Equipment, hardware, software, and/or firmware 
evaluated by the National Computer Security 
Center (NCSC) in accordance with DoD TCSEC 

and found to be technically compliant at a 
particular level of trust. The EPL is included in the 
NSA Information Systems Security Products and 
Services Catalogue. 


Occurrence, not yet assessed, that may effect the 
performance of an IS. 


One of several states in which an IS may operate, 
and the only one in which certain privileged 
instructions may be executed. Such privileged 
instructions cannot be executed when the system 
is operating in other states. Synonymous with 
supervisor state. 


Key used exclusively to safeguard communications 
transmitted over-the-air during military or 
organized civil training exercises. 


Channel that allows the violation of the security 
policy governing an IS and is usable or detectable 
by subjects external to the trusted computing 
base. See covert channel. 
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extraction resistance Capability of crypto-equipment or secure 
telecommunications equipment to resist efforts to 
extract key. 


F 


fail safe Automatic protection of programs and/or 
processing systems when hardware or software 
failure is detected. 


fail soft Selective termination of affected nonessential 
processing when hardware or software failure is 
determined to be imminent. 


failure access Type of incident in which unauthorized access to 
data results from hardware or software failure. 


failure control Methodology used to detect imminent hardware or 
software failure and provide fail safe or fail soft 
recovery. 

fetch protection IS hardware provided restriction to prevent a 


program from accessing data in another user’s 
segment of storage. 


file protection Aggregate of processes and procedures designed to 
inhibit unauthorized access, contamination, 
elimination, modification, or destruction of a file or 
any of its contents. 


file security Means by which access to computer files is limited 
to authorized users only. 


fill device COMSEC item used to transfer or store key in 
electronic form or to insert key into a crypto- 
equipment. 

FIREFLY Key management protocol based on public key 
cryptography. 

firewall System designed to defend against unauthorized 


access to or from a private network. 
firmware Program recorded in permanent or semipermanent 


computer memory. 
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fixed COMSEC facility 


flaw 


flaw hypothesis methodology 


flooding 
formal access approval 


formal development 
methodology 


formal proof 


formal security policy model 


formal top-level specification 


formal verification 
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COMSEC facility located in an immobile structure 
or aboard a ship. 


Error of commission, omission, or oversight in an 
IS that may allow protection mechanisms to be 
bypassed. 


System analysis and penetration technique in 
which the specification and documentation for an 
IS are analyzed to produce a list of hypothetical 
flaws. This list is prioritized on the basis of the 
estimated probability that a flaw exists on the ease 
of exploiting it, and on the extent of control or 
compromise it would provide. The prioritized list is 
used to perform penetration testing of a system. 


Type of incident involving insertion of a large 
volume of data resulting in denial of service. 


Documented approval by a data owner allowing 
access to a particular category of information. 


Software development strategy that proves security 
design specifications. 


Complete and convincing mathematical argument 
presenting the full logical justification for each 
proof step and for the truth of a theorem or set of 
theorems. 


Mathematically precise statement of a security 
policy. Such a model must define a secure state, 
an initial state, and how the model represents 
changes in state. The model must be shown to be 
secure by proving the initial state is secure and all 
possible subsequent states remain secure. 


Top-level specification written in a formal 
mathematical language to allow theorems, showing 
the correspondence of the system specification to 
its formal requirements, to be hypothesized and 
formally proven. 


Process of using formal proofs to demonstrate the 
consistency between formal specification of a 
system and formal security policy model (design 
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frequency hopping 


front-end security filter 


full maintenance 


functional proponent 


functional testing 


G 


gateway 


granularity 
guard 


Gypsy verification environment 
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verification) or between formal specification and its 
high-level program implementation 
(implementation verification). 


Repeated switching of frequencies during radio 
transmission according to a specified algorithm, to 
minimize unauthorized interception or jamming of 
telecommunications. 


Security filter logically separated from the 
remainder of an IS to protect system integrity. 
Synonymous with firewall. 


Complete diagnostic repair, modification, and 
overhaul of INFOSEC equipment, including repair 
of defective assemblies by piece part replacement. 
Also known as depot maintenance. See limited 
maintenance. 


See network sponsor. 


Segment of security testing in which advertised 
security mechanisms of an IS are tested under 
operational conditions. 


Interface providing a compatibility between 
networks by converting transmission speeds, 
protocols, codes, or security measures. 


Relative fineness to which an access control 
mechanism can be adjusted. 


Process limiting the exchange of information 
between systems. 


Integrated set of software tools for specifying, 
coding, and verifying programs written in the 
Gypsy language. 
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hacker 


handshaking procedures 


hard copy key 


hardwired key 


hash total 


hashing 


hashword 


identification 


identity token 


identity validation 


imitative communications 
deception 


impersonating 


implant 
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Unauthorized user who attempts to or gains access 
to an IS. 


Dialogue between two IS’s for synchronizing, 
identifying, and authenticating themselves to one 
another. 


Physical keying material, such as printed key lists, 
punched or printed key tapes, or programmable, 
read-only memories (PROM). 


Permanently installed key. 


Value computed on data to detect error or 
manipulation. See checksum. 


Computation of a hash total. 


Memory address containing hash total. 


Process an IS uses to recognize an entity. 


Smart card, metal key, or other physical object 
used to authenticate identity. 


Tests enabling an IS to authenticate users or 
resources. 


Introduction of deceptive messages or signals into 
an adversary's telecommunications signals. See 
communications deception and manipulative 
communications deception. 


Form of spoofing. 
Electronic device or electronic equipment 


modification designed to gain unauthorized 
interception of information-bearing emanations. 
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inadvertent disclosure 


incident 


incomplete parameter checking 


indicator 


individual accountability 


information assurance (IA) 


information environment 


information flow control 


information operations (IO) 


information system (IS) 
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Type of incident involving accidental exposure of 
information to a person not authorized access. 


(IS) Assessed occurrence having actual or 
potentially adverse effects on an IS. 


(COMSEC) Occurrence that potentially jeopardizes 
the security of COMSEC material or the secure 
electrical transmission of national security 
information or information governed by 10 U.S.C. 
Section 2315. 


System flaw that exists when the operating system 
does not check all parameters fully for accuracy 
and consistency, thus making the system 
vulnerable to penetration. 


A recognized action, specific, generalized, or 
theoretical, that an adversary might be expected to 
take in preparation for an attack. 


Ability to associate positively the identity of a user 
with the time, method, and degree of access to an 
IS. 


Information operations that (IO) protect and defend 
information and information systems by ensuring 
their availability, integrity, authentication, 
confidentiality, and nonrepudiation. This includes 
providing for restoration of information systems by 
incorporating protection, detection, and reaction 
capabilities. 


Aggregate of individuals, organizations, or systems 
that collect, process, or disseminate information, 
also included is the information itself. 


Procedure to ensure that information transfers 
within an IS are not made from a higher security 
level object to an object of a lower security level. 


Actions taken to affect adversary information and 
ISs while defending one’s own information and ISs. 


The entire infrastructure, organization, personnel, 
and components for the collection, processing, 
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information systems security 
(INFOSEC and/or ISS) 


information systems security 
engineering (ISSE) 


information systems security 
equipment modification 


information systems security 
manager (ISSM) 


information systems 
security officer (ISSO) 


information systems security 
product 


initialize 
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storage, transmission, display, dissemination, and 
disposition of information. 


Protection of information systems against 
unauthorized access to or modification of 
information, whether in storage, processing or 
transit, and against the denial of service to 
authorized users, including those measures 
necessary to detect, document, and counter such 
threats. 


Effort to achieve and maintain optimal security 
and survivability of a system throughout its life 
cycle. 


Modification of any fielded hardware, firmware, 
software, or portion thereof, under NSA 
configuration control. There are three classes of 
modifications: mandatory (to include human 
safety); optional/special mission modifications; 
and repair actions. These classes apply to 
elements, subassemblies, equipment, systems, and 
software packages performing functions such as 
key generation, key distribution, message 
encryption, decryption, authentication, or those 
mechanisms necessary to satisfy security policy, 
labeling, identification, or accountability. 


Principal advisor on computer security matters. 


Person responsible to the designated approving 
authority for ensuring the security of an 
information system throughout its life cycle, from 
design through disposal. Synonymous with system 
security officer. 


Item (chip, module, assembly, or equipment), 
technique, or service that performs or relates to 
information systems security. 


Setting the state of a cryptographic logic prior to 


key generation, encryption, or other operating 
mode. 
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inspectable space 


integrity 


integrity check value 


interface 


interface control document 


interim approval 


internal security controls 


internetwork private line 
interface 


internet protocol (IP) 
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Three dimensional space surrounding equipment 
that process classified and/or sensitive information 
within which TEMPEST exploitation is not 
considered practical or where legal authority to 
identify and/or remove a potential TEMPEST 
exploitation exists. Synonymous with zone of 
control. 


Quality of an IS reflecting the logical correctness 
and reliability of the operating system; the logical 
completeness of the hardware and software 
implementing the protection mechanisms; and the 
consistency of the data structures and occurrence 
of the stored data. Note that, in a formal security 
mode, integrity is interpreted more narrowly to 
mean protection against unauthorized modification 
or destruction of information. 


Checksum capable of detecting modification of an 
IS. 


Common boundary between independent systems 
or modules where interactions take place. 


Technical document describing interface controls 
and identifying the authorities and responsibilities 
for ensuring the operation of such controls. This 
document is baselined during the preliminary 
design review and is maintained throughout the IS 
lifecycle. 


Temporary authorization granted by a DAA for an 
IS to process information based on preliminary 
results of a security evaluation of the system. 


Hardware, firmware, or software features within an 
IS that restrict access to resources only to 
authorized subjects. 


Network cryptographic unit that provides secure 
connections, singularly or in simultaneous 
multiple connections, between a host and a 
predetermined set of corresponding hosts. 


Standard protocol for transmission of data from 
source to destinations in packet-switched 
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intrusion 


K 


key 


key-auto-key (KAK) 


key card 
(C.F.D.) 


key distribution center (KDC) 


key-encryption-key (KEK) 


key list 


key management 


key pair 


key production key (KPK) 
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communications networks and interconnected 
systems of such networks. 


Unauthorized act of bypassing the security 
mechanisms of a system. 


Usually a sequence of random or pseudorandom 
bits used initially to set up and periodically 
change the operations performed in crypto- 
equipment for the purpose of encrypting or 
decrypting electronic signals, or for determining 
electronic counter-countermeasures patterns, or 
for producing other key. 


Cryptographic logic using previous key to produce 
key. 


Paper card, containing a pattern of punched holes, 
that establishes key for a specific cryptonet at a 
specific time. 


COMSEC facility generating and distributing key in 
electrical form. 


Key that encrypts or decrypts other key for 
transmission or storage. 


Printed series of key settings for a specific 
cryptonet. Key lists may be produced in list, pad, 
or printed tape format. 


Supervision and control of the process whereby key 
is generated, stored, protected, transferred, loaded, 
used, and destroyed. 


Public key and its corresponding private key as 
used in public key cryptography. 


Key used to initialize a keystream generator for the 
production of other electronically generated key. 


32 


UNCLASSIFIED 


437 


key recovery 


key stream 


key tag 
key tape 
key updating 


keying material 


L 


label 


labeled security protections 


laboratory attack 


least privilege 


level of protection 
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Mechanisms and processes that allow authorized 
parties to retrieve the cryptographic key used for 
data confidentiality. 


Sequence of symbols (or their electrical or 
mechanical equivalents) produced in a machine or 
auto-manual cryptosystem to combine with plain 
text to produce cipher text, control transmission 
security processes, or produce key. 


Identification information associated with certain 
types of electronic key. 


Punched or magnetic tape containing key. Printed 
key in tape form is referred to as a key list. 


Irreversible cryptographic process for modifying 
key. 


Key, code, or authentication information in 
physical or magnetic form. 


See security label. 


Elementary-level mandatory access control 
protection features and intermediate-level 
discretionary access control features in a TCB that 
uses sensitivity labels to make access control 
decisions. 


Use of sophisticated signal recovery equipment in a 
laboratory environment to recover information from 
data storage media. 


Principle requiring that each subject be granted 
the most restrictive set of privileges needed for the 
performance of authorized tasks. Application of 
this principle limits the damage that can result 
from accident, error, or unauthorized use of an IS. 


Extent to which protective measures, techniques, 
and procedures must be applied to ISs and 
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limited maintenance 


line conditioning 


line conduction 


link encryption 


list-oriented 


local authority 


Local Management Device/ 
Key Processor (LMD/KP) 


lock and key protection system 
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networks based on risk, threat, vulnerability, 
system interconnectivity considerations, and 
information assurance needs. Levels of protection 
are: 1. Basic: IS and networks requiring 
implementation of standard minimum security 
countermeasures. 2. Medium: IS and networks 
requiring layering of additional safeguards above 
the standard minimum security countermeasures. 
3. High: IS and networks requiring the most 
stringent protection and rigorous security 
countermeasures. 


COMSEC maintenance restricted to fault isolation, 
removal, and replacement of plug-in assemblies. 
Soldering or unsoldering usually is prohibited in 
limited maintenance. See full maintenance. 


Elimination of unintentional signals or noise 
induced or conducted on a telecommunications or 
IS signal, power, control, indicator, or other 
external interface line. 


Unintentional signals or noise induced or 
conducted on a telecommunications or IS signal, 
power, control, indicator, or other external 
interface line. 


Encryption of information between nodes of a 
communications system. 


IS protection in which each protected object has a 
list of all subjects authorized to access it. See also 
ticket-oriented. 


Organization responsible for generating and 
signing user certificates. 


An EKMS platform providing automated 
management of COMSEC material and generating 
key for designated users. 


Protection system that involves matching a key or 
password with a specific access requirement. 
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logic bomb Resident computer program triggering an 
unauthorized act when particular states of an IS 
are realized. 


logical completeness measure Means for assessing the effectiveness and degree to 
which a set of security and access control 
mechanisms meets security specifications. 


long title Descriptive title of a COMSEC item. 


low probability of detection Result of measures used to hide or disguise 
intentional electromagnetic transmissions. 


low probability of intercept Result of measures to prevent the intercept of 
intentional electromagnetic transmissions. 


M 


magnetic remanence Magnetic representation of residual information 
remaining on a magnetic medium after the 
medium has been cleared. See clearing. 


maintenance hook Special instructions (trapdoors) in software 
allowing easy maintenance and additional feature 
development. Since maintenance hooks frequently 
allow entry into the code without the usual 
checks, they are a serious security risk if they are 
not removed prior to live implementation. 


maintenance key Key intended only for in-shop use. 


malicious applets Small application programs automatically 
downloaded and executed that perform an 
unauthorized function on an IS. 


malicious code Software or firmware capable of performing an 
unauthorized process on an IS. 


malicious logic Hardware, software, or firmware capable of 
performing an unauthorized function on an IS. 


mandatory access control Means of restricting access to objects 
(MAC) based on the sensitivity of the information 
contained in the objects and the formal 


authorization (i.e., clearance, formal access 
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mandatory modification 


manipulative communications 
deception 


manual cryptosystem 


manual remote rekeying 


masquerading 


master crypto-ignition key 


material symbol 
(MATSYM) (C.F.D.) 


memory scavenging 


message authentication code 


message externals 


message indicator 
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approvals, and need-to-know) of subjects to access 
information of such sensitivity. See discretionary 
access control. 


Change to a COMSEC end-item that NSA requires 
to be completed and reported by a specified date. 
See optional modification. 


Alteration or simulation of friendly 
telecommunications for the purpose of deception. 
See communications deception and imitative 
communications deception. 


Cryptosystem in which the cryptographic processes 
are performed without the use of crypto-equipment 
or auto-manual devices. 


Procedure by which a distant crypto-equipment is 
rekeyed electrically, with specific actions required 
by the receiving terminal operator. 


Form of spoofing. 


A key device with electronic logic and circuits 
providing the capability for adding more 
operational CIKs to a keyset (maximum of seven) 
any time after fill procedure is completed. The 
master CIK can only be made during the fill 
procedure as the first CIK. 


Communications circuit identifier used for key 
card resupply purposes. 


The collection of residual information from data 
storage. 


Data associated with an authenticated message 
allowing a receiver to verify the integrity of the 
message. 


Information outside of the message text, such as 
the header, trailer, etc. 


Sequence of bits transmitted over a 
communications system for synchronizing crypto- 
equipment. Some off-line cryptosystems, such as 
the KL-51 and one-time pad systems, employ 
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message indicators to establish decryption starting 


points. 
mimicking Form of spoofing. 
mode of operation Description of the conditions under which an IS 


operates based on the sensitivity of information 
processed and the clearance levels, formal access 
approvals, and need-to-know of its users. Four 
modes of operation are authorized for processing or 
transmitting information: dedicated mode, system- 
high mode, compartmented/partitioned mode, and 
multilevel mode. 


multilevel device Equipment trusted to properly maintain and 
separate data of different security categories. 


multilevel mode INFOSEC mode of operation wherein all the 
following statements are satisfied concerning the 
users who have direct or indirect access to the 
system, its peripherals, remote terminals, or 
remote hosts: a. some users do not have a valid 
security clearance for all the information processed 
in the IS; b. all users have the proper security 
clearance and appropriate formal access approval 
for that information to which they have access; and 
c. all users have a valid need-to-know only for 
information to which they have access. 


multilevel security (MLS) Concept of processing information with different 
classifications and categories that simultaneously 
permits access by users with different security 
clearances and denies access to users who lack 
authorization. 


mutual suspicion Condition in which two IS’s need to rely upon each 
other to perform a service, yet neither trusts the 
other to properly protect shared data. 
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national security information 
(NSD) 


national security system 


need-to-know 


network 
network front-end 


network reference monitor 
network security 


network security architecture 


network security officer 


network sponsor 
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Information that has been determined, pursuant to 
Executive Order 12958 or any predecessor order, 
to require protection against unauthorized 
disclosure. 


Any telecommunications or information system 
operated by the United States Government, the 
function, operation, or use of which: 1. involves 
intelligence activities; 2. involves cryptologic 
activities related to national security; 3. involves 
command and control of military forces; 4. 
involves equipment that is an integral part of a 
weapon or weapon system; or 5. is critical to the 
direct fulfillment of military or intelligence 
missions and does not include a system that is to 
be used for routine administrative and business 
applications (including payroll, finance, logistics, 
and personnel management applications). (Title 40 
U.S.C. Section1452, Information Technology 
Management Reform Act of 1996.) 


The necessity for access to, or knowledge or 
possession of, specific information required to 
carry out official duties. 


IS implemented with a collection of interconnected 
nodes. 


Device implementing protocols that allow 
attachment of a computer system to a network. 


See reference monitor. 
See information systems security. 


Subset of network architecture specifically 
addressing security-relevant issues. 


See information systems security officer. 


Individual or organization responsible for stating 
the security policy enforced by the network, 
designing the network security architecture to 


properly enforce that policy, and ensuring the 
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network system 


network trusted computing base 
(NTCB) 


network trusted computing base 
(NTCB) partition 


network weaving 


no-lone zone 


nonrepudiation 


null 
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network is implemented in such a way that the 
policy is enforced. 


System implemented with a collection of 
interconnected components. A network system is 
based on a coherent security architecture and 
design. 


Totality of protection mechanisms within a 
network, including hardware, firmware, and 
software, the combination of which is responsible 
for enforcing a security policy. See trusted 
computing base. 


Totality of mechanisms within a single network 
component for enforcing the network policy, as 
allocated to that component; the part of the NTCB 
within a single network component. 


Penetration technique in which different 
communication networks are linked to access an 
IS to avoid detection and trace-back. 


Area, room, or space that, when staffed, must be 
occupied by two or more appropriately cleared 
individuals who remain within sight of each other. 
See two-person integrity. 


Assurance the sender of data is provided with proof 
of delivery and the recipient is provided with proof 
of the sender's identity, so neither can later deny 
having processed the data. 


Dumny letter, letter symbol, or code group 
inserted into an encrypted message to delay or 
prevent its decryption or to complete encrypted 
groups for transmission or transmission security 
purposes. 
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object 


object reuse 


off-line cryptosystem 


one-part code 


one-time cryptosystem 


one-time pad 


one-time tape 


on-line cryptosystem 


open storage 


operational data security 
(C.F.D) 
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Passive entity containing or receiving information. 
Access to an object implies access to the 
information it contains. 


Reassignment and re-use of a storage medium 
containing one or more objects after ensuring no 
residual data remains on the storage medium. 


Cryptosystem in which encryption and decryption 
are performed independently of the transmission 
and reception functions. 


Code in which plain text elements and their 
accompanying code groups are arranged in 
alphabetical, numerical, or other systematic order, 
so one listing serves for both encoding and 
decoding. One-part codes are normally small 
codes used to pass small volumes of low-sensitivity 
information. 


Cryptosystem employing key used only once. 


Manual one-time cryptosystem produced in pad 
form. 


Punched paper tape used to provide key streams 
on a one-time basis in certain machine 
cryptosystems. 


Cryptosystem in which encryption and decryption 
are performed in association with the transmitting 
and receiving functions. 


Storage of classified information within an 
accredited facility, but not in General Services 
Administration approved secure containers, while 
the facility is unoccupied by authorized personnel. 


Protection of data from either accidental or 
unauthorized intentional modification, destruction, 
or disclosure during input, processing, storage, 
transmission, or output operations. 
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operational key 


operational waiver 


operations code 


operations security (OPSEC) 


optional modification 


Orange Book 
(C.F.D) 


organizational maintenance 


organizational registration 
authority (ORA) 


over-the-air key distribution 


over-the-air key transfer 


over-the-air rekeying (OTAR) 


NSTISSI No. 4009 


UNCLASSIFIED 


Key intended for use over-the-air for protection of 
operational information or for the production or 
secure electrical transmission of key streams. 


Authority for continued use of unmodified 
COMSEC end-items pending the completion of a 
mandatory modification. 


Code composed largely of words and phrases 
suitable for general communications use. 


Process denying information to potential 
adversaries about capabilities and/or intentions by 
identifying, controlling, and protecting unclassified 
generic activities. 


NSA-approved modification not required for 
universal implementation by all holders of a 
COMSEC end-item. This class of modification 
requires all of the engineering/doctrinal control of 
mandatory modification but is usually not related 
to security, safety, TEMPEST, or reliability. 


The DoD Trusted Computer System Evaluation 
Criteria (DoD 5200.28-STD). 


Limited maintenance performed by a user 
organization. 


Entity within the PKI that authenticates the 
identity and the organizational affiliation of the 
users. 


Providing electronic key via over-the-air rekeying, 
over-the-air key transfer, or cooperative key 
generation. 


Electronically distributing key without changing 
traffic encryption key used on the secured 
communications path over which the transfer is 
accomplished. 


Changing traffic encryption key or transmission 


security key in remote crypto-equipment by 
sending new key directly to the remote crypto- 
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overt channel 


overwrite procedure 


P 


parity 


partitioned security mode 


password 


penetration 


penetration testing 


per-call key 


periods processing 
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equipment over the communications path it 
secures. 


Communications path within a computer system 
or network designed for the authorized transfer of 
data. See covert channel. 


Process of writing patterns of data on top of the 
data stored on a magnetic medium. 


Bit(s) used to determine whether a block of data 
has been altered. 


IS security mode of operation wherein all personnel 
have the clearance, but not necessarily formal 
access approval and need-to-know, for all 
information handled by an IS. 


Protected/private alphanumeric string used to 
authenticate an identity or to authorize access to 
data. 


See intrusion. 


Security testing in which evaluators attempt to 
circumvent the security features of a system based 
on their understanding of the system design and 
implementation. 


Unique traffic encryption key generated 
automatically by certain secure 
telecommunications systems to secure single voice 
or data transmissions. See cooperative key 
generation. 


Processing of various levels of classified and 
unclassified information at distinctly different 
times. Under the concept of periods processing, 
the system must be purged of all information from 
one processing period before transitioning to the 
next. 
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permuter Device used in crypto-equipment to change the 
order in which the contents of a shift register are 
used in various nonlinear combining circuits. 


plain text Unencrypted information. 


policy approving authority (PAA) First level of the PKI Certification Management 
Authority that approves the security policy of each 
PCA. 


policy certification authority (PCA) Second level of the PKI Certification Management 
Authority that formulates the security policy under 
which it and its subordinate CAs will issue public 
key certificates. 


positive control material Generic term referring to a sealed authenticator 
system, permissive action link, coded switch 
system, positive enable system, or nuclear 
command and control documents, material, or 
devices. 


preproduction model Version of INFOSEC equipment employing 
standard parts and suitable for complete 
evaluation of form, design, and performance. 
Preproduction models are often referred to as beta 
models. 


print suppression Eliminating the display of characters in order to 
preserve their secrecy. 


privacy system Commercial encryption system that affords 
telecommunications limited protection to deter a 
casual listener, but cannot withstand a technically 
competent cryptanalytic attack. 


privileged access Explicitly authorized access of a specific user, 
process, or computer to a computer resource(s). 


probe Type of incident involving an attempt to gather 
information about an IS for the apparent purpose 
of circumventing its security controls. 


production model INFOSEC equipment in its final mechanical and 
electrical form. 


proprietary information Material and information relating to or associated 
with a company’s products, business, or activities, 
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protected communications 
(C.F.D.) 


protected distribution systems 
(PDS) 


protection philosophy 


protection ring 


protective packaging 


protective technologies 
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including but not limited to financial information; 
data or statements; trade secrets; product research 
and development; existing and future product 
designs and performance specifications; marketing 
plans or techniques; schematics; client lists; 
computer programs; processes; and know-how that 
have been clearly identified and properly marked 
by the company as proprietary information, trade 
secrets, or company confidential information. The 
information must have been developed by the 
company and not be available to the Government 
or to the public without restriction from another 
source. 


Telecommunications deriving their protection 
through use of type 2 products or data encryption 
standard equipment. See type 2 product. 


Wire line or fiber optic distribution system used to 
transmit unencrypted classified national security 
information through an area of lesser classification 
or control. 


Informal description of the overall design of an IS 
delineating each of the protection mechanisms 
employed. Combination of formal and informal 
techniques, appropriate to the evaluation class, 
used to show the mechanisms are adequate to 
enforce the security policy. 


One of a hierarchy of privileged modes of an IS that 
gives certain access rights to user programs and 
processes that are authorized to operate in a given 
mode. 


Packaging techniques for COMSEC material that 
discourage penetration, reveal a penetration has 
occurred or was attempted, or inhibit viewing or 
copying of keying material prior to the time it is 
exposed for use. 


Special tamper-evident features and materials 
employed for the purpose of detecting tampering 
and deterring attempts to compromise, modify, 
penetrate, extract, or substitute information 
processing equipment and keying material. 
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450 


protective technology/ 
package incident 
(C.F.D.) 


protocol 


proxy 


public key certificate 


public cryptography 
(C.F.D.) 


public key cryptography (PKC) 


public key infrastructure (PKI) 


purging 


Q 


QUADRANT 


R 


rainbow series 
(C.F.D.) 
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Any penetration of INFOSEC protective technology 
or packaging, such as a crack, cut, or tear. 


Set of rules and formats, semantic and syntactic, 
permiting IS’s to exchange information. 


Software agent that performs a function or 
operation on behalf of another application or 
system while hiding the details involved. 


Contains the name of a user, the public key 
component of the user, and the name of the issuer 
who vouches that the public key component is 
bound to the named user. 


Body of cryptographic and related knowledge, 
study, techniques, and applications that is, or is 
intended to be, in the public domain. 


Encryption system using a linked pair of keys. 
What one key encrypts, the other key decrypts. 


Framework established to issue, maintain, and 
revoke public key certificates accommodating a 
variety of security technologies, including the use 
of software. 


Rendering stored information unrecoverable. See 
sanitize. 


Short name referring to technology that provides 
tamper-resistant protection to crypto-equipment. 


Set of publications that interpret Orange Book 
requirements for trusted systems. 
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randomizer 


read 


read access 


real time reaction 


recovery procedures 


RED/BLACK concept 


Red team 


RED signal 


reference monitor 


reference validation mechanism 
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Analog or digital source of unpredictable, 
unbiased, and usually independent bits. 
Randomizers can be used for several different 
functions, including key generation or to provide a 
starting state for a key generator. 


Fundamental operation in an IS that results only 
in the flow of information from an object to a 
subject. 


Permission to read information in an IS. 


Immediate response to a penetration attempt that 
is detected and diagnosed in time to prevent 
access. 


Actions necessary to restore data files of an IS and 
computational capability after a system failure. 


Designation applied to an IS, and associated areas, 
circuits, components, and equipment in which 
unencrypted national security information is being 
processed. 


Separation of electrical and electronic circuits, 
components, equipment, and systems that handle 
national security information (RED), in electrical 
form, from those that handle non-national security 
information (BLACK) in the same form. 


Independent and focused threat-based effort by an 
interdisciplinary, simulated adversary to expose 
and exploit vulnerabilities as a means to improve 
the security posture of ISs. 


Any electronic emission (e.g., plain text, key, key 
stream, subkey stream, initial fill, or control signal) 
that would divulge national security information if 
recovered. 


Access control concept referring to an abstract 
machine that mediates all accesses to objects by 
subjects. 


Portion of a trusted computing base whose normal 
function is to control access between subjects and 
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451 


release prefix 


remanence 


remote rekeying 


repair action 


reserve keying material 
residual risk 


residue 


resource encapsulation 


risk 
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objects and whose correct operation is essential to 
the protection of data in the system. 


Prefix appended to the short title of U.S.-produced 
keying material to indicate its foreign releasability. 
"A" designates material that is releasable to specific 
allied nations and "U.S." designates material 
intended exclusively for U. S. use. 


Residual information remaining on storage media 
after clearing. See magnetic remanence and 
clearing. 


Procedure by which a distant crypto-equipment is 
rekeyed electrically. See automatic remote 
rekeying and manual remote rekeying. 


NSA-approved change to a COMSEC end-item that 
does not affect the original characteristics of the 
end-item and is provided for optional application 
by holders. Repair actions are limited to minor 
electrical and/or mechanical improvements to 
enhance operation, maintenance, or reliability. 
They do not require an identification label, 
marking, or control but must be fully documented 
by changes to the maintenance manual. 


Key held to satisfy unplanned needs. See 
contingency key. 


Portion of risk remaining after security measures 
have been applied. 


Data left in storage after information processing 
operations are complete, but before degaussing or 
overwriting has taken place. 


Method by which the reference monitor mediates 
accesses to an IS resource. Resource is protected 
and not directly accessible by a subject. Satisfies 
requirement for accurate auditing of resource 
usage. 


Possibility that a particular threat will adversely 
impact an IS by exploiting a particular 


vulnerability. 


47 


UNCLASSIFIED 
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risk analysis 


risk assessment 


risk index 


risk management 


S 


safeguarding statement 


sanitize 


scavenging 


scratch pad store (SPS) 
(C.F.D.) 


secure communications 


secure hash standard 


secure operating system 
(C.F.D.) 
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Examination of information to identify the risk to 
an IS. 


Formal description and evaluation of risk to an IS. 


Difference between the minimum clearance or 
authorization of IS users and the maximum 
sensitivity (e.g., classification and categories) of 
data processed by the system. 


Process of identifying and applying 
countermeasures commensurate with the value of 
the assets protected based on a risk assessment. 


Statement affixed to a computer output or printout 
that states the highest classification being 
processed at the time the product was produced 
and requires control of the product, at that level, 
until determination of the true classification by an 
authorized person. Synonymous with banner. 


Process to remove information from media such 
that data recovery is not possible. It includes 
removing all classified labels, markings, and 
activity logs. See purging. 


Searching through object residue to acquire data. 
Temporary key storage in crypto-equipment. 
Telecommunications deriving security through use 
of type 1 products and/or PDSs. 


Specification for a secure hash algorithm that can 
generate a condensed message representation 
called a message digest. 


Resident software controlling hardware and other 


software functions in an IS to provide a level of 
protection or security appropriate to the 
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secure state 


secure subsystem 


security fault analysis 
(SFA) 


security features users guide 
(SFUG) 


security filter 


security flaw 
(C.F.D.) 


security inspection 


security kernel 


security label 


security net control station 
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classification, sensitivity, and/or criticality of the 
data and resources it manages. 


Condition in which no subject can access any 
object in an unauthorized manner. 


Subsystem containing its own implementation of 
the reference monitor concept for those resources 
it controls. Secure subsystem must depend on 
other controls and the base operating system for 
the control of subjects and the more primitive 
system objects. 


Assessment, usually performed on IS hardware, to 
determine the security properties of a device when 
hardware fault is encountered. 


Guide or manual explaining how the security 
mechanisms in a specific system work. 


IS trusted subsystem that enforces security policy 
on the data passing through it. 


Error of commission or omission in an IS that may 
allow protection mechanisms to be bypassed. See 
vulnerability. 


Examination of an IS to determine compliance with 
security policy, procedures, and practices. 


Hardware, firmware, and software elements of a 
trusted computing base implementing the 
reference monitor concept. Security kernel must 
mediate all accesses, be protected from 
modification, and be verifiable as correct. 


Information representing the sensitivity of a 
subject or object, such as its hierarchical 
classification (CONFIDENTIAL, SECRET, TOP 
SECRET) together with any applicable 
nonhierarchical security categories 

(e.g., sensitive compartmented information, critical 
nuclear weapon design information). 


Management system overseeing and controlling 
implementation of network security policy. 
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454 


security perimeter 


security policy 


security range 


security requirements 


security requirements baseline 


security safeguards 


security specification 


security test and evaluation 
(ST&E) 


security testing 


seed key 


sensitive information 
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All components/devices of an IS to be accredited. 
Separately accredited components generally are 
not included within the perimeter. 


See information systems security policy. 


Highest and lowest security levels that are 
permitted in or on an IS, system component, 
subsystem, or network. 


Types and levels of protection necessary for 
equipment, data, information, applications, and 
facilities to meet IS security policy. 


Description of the minimum requirements 
necessary for an IS to maintain an acceptable level 
of security. 


Protective measures and controls prescribed to 
meet the security requirements specified for an IS. 
Safeguards may include security features, 
management constraints, personnel security, and 
security of physical structures, areas, and devices. 
See accreditation. 


Detailed description of the safeguards required to 
protect an IS. 


Examination and analysis of the safeguards 
required to protect an IS, as they have been 
applied in an operational environment, to 
determine the security posture of that system. 


Process to determine that an IS protects data and 
maintains functionality as intended. 


Initial key used to start an updating or key 
generation process. 


Information, the loss, misuse, or unauthorized 
access to or modification of, which could adversely 
affect the national interest or the conduct of federal 
programs, or the privacy to which individuals are 
entitled under 5 U.S.C. Section 552a (the Privacy 
Act), but that has not been specifically authorized 
under criteria established by an Executive Order or 
an Act of Congress to be kept classified in the 
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455 


sensitivity label 


shielded enclosure 


short title 


simple security property 


single-level device 
(C.F.D.) 


single point keying 
sniffer 


software system test and 
evaluation process 


special mission modification 
(C.F.D.) 


speech privacy 
(C.F.D.) 
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interest of national defense or foreign policy. 
(Systems that are not national security systems, 
but contain sensitive information, are to be 
protected in accordance with the requirements of 
the Computer Security Act of 1987 (P.L.100-235).) 


Information representing elements of the security 
label(s) of a subject and an object. Sensitivity 
labels are used by the trusted computing base 
(TCB) as the basis for mandatory access control 
decisions. 


Room or container designed to attenuate 
electromagnetic radiation. 


Identifying combination of letters and numbers 
assigned to certain COMSEC materials to facilitate 
handling, accounting, and controlling. 


Bell-La Padula security model rule allowing a 
subject read access to an object, only if the 
security level of the subject dominates the security 
level of the object. 


IS device not trusted to properly maintain and 
separate data to different security levels. 


Means of distributing key to multiple, local crypto- 
equipment or devices from a single fill point. 


Software tool for auditing and identifying network 
traffic packets. 


Process that plans, develops, and documents the 
quantitative demonstration of the fulfillment of all 
baseline functional performance, operational, and 
interface requirements. 


Mandatory or optional modification that applies 
only to a specific mission, purpose, operational, or 
environmental need. 


Techniques using fixed sequence permutations or 


voice /speech inversion to render speech 
unintelligible to the casual listener. 
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split knowledge 


spoofing 


spread spectrum 


star (*) property 


start-up KEK 


state variable 
storage object 


subassembly 


subject 


subject security level 
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Separation of data or information into two or more 
parts, each part constantly kept under control of 
separate authorized individuals or teams so that 
no one individual or team will know the whole 
data. 


Unauthorized use of legitimate Indentification and 
Authentication (I&A) data, however it was obtained, 
to mimic a subject different from the attacker. 
Impersonating, masquerading, piggybacking, and 
mimicking are forms of spoofing. 


Telecommunications techniques in which a signal 
is transmitted in a bandwidth considerably greater 
than the frequency content of the original 
information. Frequency hopping, direct sequence 
spreading, time scrambling, and combinations of 
these techniques are forms of spread spectrum. 


Bell-La Padula security model rule allowing a 
subject write access to an object only if the 
security level of the object dominates the security 
level of the subject. 


Key-encryption-key held in common by a group of 
potential communicating entities and used to 
establish ad hoc tactical networks. 


Variable representing either the state of an IS or 
the state of some system resource. 


An object supporting both read and write accesses 
to an IS. 


Major subdivision of an assembly consisting of a 
package of parts, elements, and circuits that 
perform a specific function. 


Generally a person, process, or device causing 
information to flow among objects or change to the 
system state. 


Sensitivity label(s) of the objects to which the 
subject has both read and write access. Security 
level of a subject must always be dominated by the 
clearance level of the user associated with the 


subject. 
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sub-registration authority (SRA) 


(C.F.D.) 


superencryption 


supersession 


superuser 
(C.F.D.) 


supervisor state 


suppression measure 


surrogate access 


syllabary 


symmetric key 


synchronous crypto-operation 


system administrator (SA) 
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Individual with primary responsibility for managing 
the distinguished name process. 


Process of encrypting encrypted information. 
Occurs when a message, encrypted off-line, is 
transmitted over a secured, on-line circuit, or when 
information encrypted by the originator is 
multiplexed onto a communications trunk, which 
is then bulk encrypted. 


Scheduled or unscheduled replacement of a 
COMSEC aid with a different edition. 


Special user who can perform control of processes, 
devices, networks, and file systems. 


Synonymous with executive state of an operating 
system. 


Action, procedure, modification, or device that 
reduces the level of, or inhibits the generation of, 
compromising emanations in an IS. 


See discretionary access control. 


List of individual letters, combination of letters, or 
syllables, with their equivalent code groups, used 
for spelling out words or proper names not present 
in the vocabulary of a code. A syllabary may also 
be a spelling table. 


Encryption methodology in which the encryptor 
and decryptor use the same key, which must be 
kept secret. 


Method of on-line crypto-operation in which 
crypto-equipment and associated terminals have 
timing systems to keep them in step. 


Individual responsible for the installation and 
maintenance of an IS, providing effective IS 
utilization, adequate security parameters, and 
sound implementation of established INFOSEC 
policy and procedures. 
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system assets 


system development 
methodologies 


system high 


system high mode 


system indicator 


system integrity 


system low 


system profile 


system security 
system security engineering 


system security evaluation 
(C.F.D.) 
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Any software, hardware, data, administrative, 
physical, communications, or personnel resource 
within an IS. 


Methodologies developed through software 
engineering to manage the complexity of system 
development. Development methodologies include 
software engineering aids and high-level design 
analysis tools. 


Highest security level supported by an IS. 


IS security mode of operation wherein each user, 
with direct or indirect access to the IS, its 
peripherals, remote terminals, or remote hosts, has 
all of the following: a. valid security clearance for 
all information within an IS; b. formal access 
approval and signed nondisclosure agreements for 
all the information stored and/or processed 
(including all compartments, subcompartments 
and/or special access programs); and c. valid 
need-to- know for some of the information 
contained within the IS. 


Symbol or group of symbols in an off-line 
encrypted message identifying the specific 
cryptosystem or key used in the encryption. 


Attribute of an IS when it performs its intended 
function in an unimpaired manner, free from 
deliberate or inadvertent unauthorized 
manipulation of the system. 


Lowest security level supported by an IS. 


Detailed security description of the physical 
structure, equipment component, location, 
relationships, and general operating environment 
of an IS. 


See information systems security. 
See information systems security. 


Risk assessment of a system, considering its 
vulnerabilities and perceived security threat. 
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459 


460 


system security management 
plan (C.F.D.) 


system security officer 


system security plan 
(C.F.D.) 


T 


tampering 


telecommunications 


telecommunications and 
automated information 
systems security (C.F.D.) 


telecommunications security 
(TSEC) 


TEMPEST 


TEMPEST test 


TEMPEST zone 


test key 


threat 
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Formal document fully describing the 
responsibilities for security tasks planned to meet 
system security requirements. 


See information system security officer. 


Formal document fully describing the planned 
security tasks required to meet system security 
requirements. 


Unauthorized modification altering the proper 
functioning of INFOSEC equipment. 


Preparation, transmission, communication, or 
related processing of information (writing, images, 
sounds, or other data) by electrical, 
electromagnetic, electromechanical, electro-optical, 
or electronic means. 


Superseded by information systems security. 


See information systems security. 


Short name referring to investigation, study, and 
control of compromising emanations from IS 
equipment. 


Laboratory or on-site test to determine the nature 
of compromising emanations associated with an IS. 


Designated area within a facility where equipment 
with appropriate TEMPEST characteristics 
(TEMPEST zone assignment) may be operated. 


Key intended for testing of COMSEC equipment or 
systems. 


Any circumstance or event with the potential to 


adversely impact an IS through unauthorized 
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threat analysis 
threat assessment 


threat monitoring 


ticket-oriented 


time bomb 


time-compliance date 


time-dependent password 


traditional COMSEC program 


traffic analysis (TA) 


traffic encryption key (TEK) 


traffic-flow security (TFS) 
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access, destruction, disclosure, modification of 
data, and/or denial of service. 


Examination of information to identify the 
elements comprising a threat. 


Formal description and evaluation of threat to an 
IS. 


Analysis, assessment, and review of audit trails 
and other information collected for the purpose of 
searching out system events that may constitute 
violations of system security. 


IS protection system in which each subject 
maintains a list of unforgeable bit patterns called 
tickets, one for each object a subject is authorized 
to access. See list-oriented. 


Resident computer program that triggers an 
unauthorized act at a predefined time. 


Date by which a mandatory modification to a 
COMSEC end-item must be incorporated if the 
item is to remain approved for operational use. 


Password that is valid only at a certain time of day 
or during a specified interval of time. 


Program in which NSA acts as the central 
procurement agency for the development and, in 
some cases, the production of INFOSEC items. 
This includes the Authorized Vendor Program. 
Modifications to the INFOSEC end-items used in 
products developed and/or produced under these 
programs must be approved by NSA. 


Study of communications patterns. 


Key used to encrypt plain text or to superencrypt 
previously encrypted text and/or to decrypt cipher 
text. 


Measure used to conceal the presence of valid 
messages in an on-line cryptosystem or secure 
communications system. 
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462 


traffic padding 


training key 
(C.F.D.) 


tranquility 


transmission security 
(TRANSEC) 


trap door 


trojan horse 


trusted computer system 


trusted computing base (TCB) 


trusted distribution 


trusted facility manual 


trusted identification 
forwarding 
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Generation of spurious communications or data 
units to disguise the amount of real data units 
being sent. 


Cryptographic key for training. 


Property whereby the security level of an object 
cannot change while the object is being processed 
by an IS. 


Component of COMSEC resulting from the 
application of measures designed to protect 
transmissions from interception and exploitation 
by means other than cryptanalysis. 


Synonymous with back door. 


Program containing hidden code allowing the 
unauthorized collection, falsification, or 
destruction of information. See malicious code. 


IS employing sufficient hardware and software 
assurance measures to allow simultaneous 
processing of a range of classified or sensitive 
information. 


Totality of protection mechanisms within a 
computer system, including hardware, firmware, 
and software, the combination responsible for 
enforcing a security policy. 


Method for distributing trusted computing base 
(TCB) hardware, software, and firmware 
components that protects the TCB from 
modification during distribution. 


Document containing the operational 
requirements; security environment; hardware and 
software configurations and interfaces; and all 
security procedures, measures, and contingency 
plans. 


Identification method used in IS networks whereby 
the sending host can verify an authorized user on 
its system is attempting a connection to another 
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trusted path 


trusted process 


trusted recovery 
trusted software 
TSEC nomenclature 


tunneling 


two-part code 


two-person control 


two-person integrity (TPI) 
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host. The sending host transmits the required 
user authentication information to the receiving 
host. 


Mechanism by which a person using a terminal 
can communicate directly with the trusted 
computing base (TCB). Trusted path can only be 
activated by the person or the TCB and cannot be 
imitated by untrusted software. 


Process that has privileges to circumvent the 
system security policy and has been tested and 
verified to operate only as intended. 


Ability to ensure recovery without compromise 
after a system failure. 


Software portion of a trusted computing base 
(TCB). 


System for identifying the type and purpose of 
certain items of COMSEC material. 


Technology enabling one network to send its data 
via another network’s connections. Tunneling 
works by encapsulating a network protocol within 
packets carried by the second network. 


Code consisting of an encoding section, in which 
the vocabulary items (with their associated code 
groups) are arranged in alphabetical or other 
systematic order, and a decoding section, in which 
the code groups (with their associated meanings) 
are arranged in a separate alphabetical or numeric 
order. 


Continuous surveillance and control of positive 
control material at all times by a minimum of two 
authorized individuals, each capable of detecting 
incorrect and unauthorized procedures with 
respect to the task being performed, and each 
familiar with established security and safety 
requirements. 


System of storage and handling designed to 
prohibit individual access to certain COMSEC 
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type 1 product 


type 2 product 


type 3 algorithm 


type 4 algorithm 


U 


unauthorized disclosure 


unclassified 
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keying material by requiring the presence of at 
least two authorized persons, each capable of 
detecting incorrect or unauthorized security 
procedures with respect to the task being 
performed. See no-lone zone. 


Classified or controlled cryptographic item 
endorsed by the NSA for securing classified and 
sensitive U.S. Government information, when 
appropriately keyed. The term refers only to 
products, and not to information, key, services, or 
controls. Type 1 products contain classified NSA 
algorithms. They are available to U.S. Government 
users, their contractors, and federally sponsored 
non-U.S. Government activities subject to export 
restrictions in accordance with International Traffic 
in Arms Regulation. 


Unclassified cryptographic equipment, assembly, 
or component, endorsed by the NSA, for use in 
national security systems as defined in Title 40 
U.S.C. Section 1452. 


Cryptographic algorithm registered by the National 
Institute of Standards and Technology (NIST) and 
published as a Federal Information Processing 
Standard (FIPS) for use in protecting unclassified 
sensitive information or commercial information. 


Unclassified cryptographic algorithm that has been 
registered by the National Institute of Standards 
and Technology (NIST), but not published as a 
Federal Information Processing Standard (FIPS). 


Type of event involving exposure of information to 
individuals not authorized to receive it. 


Information that has not been determined 
pursuant to E.O. 12958 or any predecessor order 
to require protection against unauthorized 
disclosure and that is not designated as classified. 
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untrusted process 


updating 


user 


user ID 


User Partnership Program 
(UPP) 


user profile 


user representative 


U.S.-controlled facility 


U.S.-controlled space 


465 


NSTISSI No. 4009 


UNCLASSIFIED 


Process that has not been evaluated or examined 
for adherence to the security policy. It may include 
incorrect or malicious code that attempts to 
circumvent the security mechanisms. 


Automatic or manual cryptographic process that 
irreversibly modifies the state of a COMSEC key, 
equipment, device, or system. 


Person or process authorized to access an IS. 


(PKI) Individual defined, registered, and bound to 
a public key structure by a certification authority 
(CA). 


Unique symbol or character string used by an IS to 
identify a specific user. 


Partnership between the NSA and a U.S. 
Government agency to facilitate development of 
secure IS equipment incorporating NSA-approved 
cryptography. The result of this program is the 
authorization of the product or system to 
safeguard national security information in the 
user's specific application. 


Patterns of a user's activity that can show changes 
from normal behavior. 


Person authorized by an organization to order 
COMSEC keying material and interface with the 
keying system, provide information to key users, 
and ensure the correct type of key is ordered. 


Base or building to which access is physically 
controlled by U.S. persons who are authorized U.S. 
Government or U.S. Government contractor 
employees. 


Room or floor within a facility that is not a U.S.- 
controlled facility, access to which is physically 
controlled by U.S. persons who are authorized U.S. 
Government or U.S. Government contractor 
employees. Keys or combinations to locks 
controlling entrance to U.S.-controlled spaces must 
be under the exclusive control of U.S. persons who 
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U.S. person 


V 


validation 


variant 


verification 


verified design 
(C.F.D.) 


virtual password 
(C.F.D.) 


virtual private network (VPN) 
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are U.S. Government or U.S. Government 
contractor employees. 


U.S. citizen or a permanent resident alien, an 
unincorporated association substantially 
composed of U.S. citizens or permanent resident 
aliens, or a corporation incorporated in U.S., 
except for a corporation directed and controlled by 
a foreign government or governments. 


Process of applying specialized security test and 
evaluation procedures, tools, and equipment 
needed to establish acceptance for joint usage of 
an IS by one or more departments or agencies and 
their contractors. 


One of two or more code symbols having the same 
plain text equivalent. 


Process of comparing two levels of an IS 
specification for proper correspondence (e.g., 
security policy model with top-level specification, 
top-level specification with source code, or source 
code with object code). 


Computer protection class in which formal security 
verification methods are used to assure mandatory 
and discretionary security controls can effectively 
protect classified and sensitive information stored 
in, or processed by, the system. Class Al system 
is verified design. 


IS password computed from a passphrase meeting 
the requirements of password storage (e.g., 64 
bits). 


Protected IS link utilizing tunneling, security 
controls (see information assurance), and end- 
point address translation giving the impression of a 
dedicated line. 
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virus 


vulnerability 


vulnerability analysis 


vulnerability assessment 


W 


work factor 


worm 


write access 


Z 


zero fill 
zeroize 


zone of control 
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Self-replicating, malicious code that attaches itself 
to an application program or other executable 
system component and leaves no obvious signs of 
its presence. 


Weakness in an IS, system security procedures, 
internal controls, or implementation that could be 
exploited. 


Examination of information to identify the 
elements comprising a vulnerability. 


Formal description and evaluation of 
vulnerabilities of an IS. 


Estimate of the effort or time needed by a potential 
perpetrator, with specified expertise and resources, 
to overcome a protective measure. 


See malicious code. 


Fundamental operation in an IS that results only 
in the flow of information from a subject to an 
object. See access type. 


Permission to write to an object in an IS. 


To fill unused storage locations in an IS with the 
representation of the character denoting "0." 


To remove or eliminate the key from a crypto- 
equipment or fill device. 


Synonymous with inspectable space. 
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UNCLASSIFIED 


467 


UNCLASSIFIED 


SECTION II 


COMMONLY USED ABBREVIATIONS AND ACRONYMS 


ACL 

ACO 

ADM (C.F.D.) 
AE (C.F.D.) 
AIG 

AIN 

AIRK (C.F.D.) 
AJ (C.F.D.) 
AK 

AKDC (C.F.D.) 
AKD/RCU 
AKMC (C.F.D.) 
AKMS (C.F.D.) 
ALC 

AMS 
ANDVT 
ANSI 

AOSS (C.F.D.) 
APC 

APU 


ARPANET (C.F.D.) 


Access Control List 

Access Control Officer 
Advanced Development Model 
Application Entity 

Address Indicator Group 
Advanced Intelligence Network 
Area Interswitch Rekeying Key 
Anti-Jamming 

Automatic Remote Rekeying 


Automatic Key Distribution Center 


Automatic Key Distribution/Rekeying Control Unit 


Automated Key Management Center 
Automated Key Management System 
Accounting Legend Code 


1. Auto-Manual System 
2. Autonomous Message Switch 


Advanced Narrowband Digital Voice Terminal 
American National Standards Institute 
Automated Office Support Systems 

Adaptive Predictive Coding 

Auxiliary Power Unit 


Advanced Research Projects Agency Network 
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UNCLASSIFIED 


468 


469 


ASCII 


ASPJ (C.F.D.) 


ASSIST Program 


ASU (C.F.D.) 


ATM 


AUTODIN 


AV (C.F.D.) 


AVP 


C2 


C3 


C31 


C4 


CA 


C&A 


CAW 


CCEP 


CCI 


CCO 


CDS (C.F.D.) 


CEOI 


UNCLASSIFIED 


American Standard Code for Information 
Interchange 


Advanced Self-Protection Jammer 


Automated Information System Security Incident 
Support Team 


Approval for Service Use 
Asynchronous Transfer Mode 
Automatic Digital Network 


Auxiliary Vector 


Authorized Vendor Program 


1. Command and Control 
2. Controlled Access Protection (C.F.D.) 


Command, Control, and Communications 


Command, Control, Communications and 
Intelligence 


Command, Control, Communications and 
Computers 


Controlling Authority 
Cryptanalysis 
COMSEC Account 
Command Authority 
Certification Authority 


Ja E 


Certification and Accreditation 

Certificate Authority Workstation 
Commercial COMSEC Endorsement Program 
Controlled Cryptographic Item 

Circuit Control Officer 

Cryptographic Device Services 


Communications Electronics Operating Instruction 
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UNCLASSIFIED 


469 


470 


CEPR 


CER 


CERT 


CFD 


CIAC 


CIK 


CIP (C.F.D.) 


CIRK (C.F.D.) 


CIRT 


CK (C.F.D.) 


CKG 


CNCS (C.F.D.) 


CND 


CNK (C.F.D.) 


COMPUSEC 


COMSEC 


CONOP 


COR 


COTS 


CPS (C.F.D.) 


CPU 


UNCLASSIFIED 


Compromising Emanation Performance 
Requirement 


1. Cryptographic Equipment Room 
2. Communication Equipment Room 


Computer Security Emergency Response Team 
Common Fill Device 

Computer Incident Assessment Capability 
Crypto-Ignition Key 

Crypto-Ignition Plug 

Common Interswitch Rekeying Key 
Computer Security Incident Response Team 
Compartment Key 

Cooperative Key Generation 

COMSEC Material Control System 
Computer Network Attack 

Cryptonet Control Station 

Computer Network Defense 

Cryptonet Key 

Computer Security 

Communications Security 

Concept of Operations 


1. Central Office of Record (COMSEC) 
2. Contracting Officer Representative 


Commercial-off-the-shelf 
COMSEC Parent Switch 
Central Processing Unit 
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UNCLASSIFIED 


470 


471 


CRL 

CRP (C.F.D.) 
Crypt/Crypto 
CSE 


CSS 


CSSO 


CSTVRP 


CTAK 
CT&E 
CTTA 
CUP 


DAA 


DAC 
DAMA 
DCID 


DCS 


DCSP (C.F.D.) 
DDS 

DES 

DIB (C.F.D.) 


DISN 


UNCLASSIFIED 


Certificate Revocation List 


COMSEC Resources Program (Budget) 


Cryptographic-related 


Communications Security Element 


PwNY 


. COMSEC Subordinate Switch 

. Constant Surveillance Service (Courier) 
. Continuous Signature Service (Courier) 
. Coded Switch System 


Contractor Special Security Officer 


Computer Security Technical Vulnerability Report 


Program 


Cipher Text Auto-Key 


Certification Test and Evaluation 


Certified TEMPEST Technical Authority 


COMSEC Utility Program 


l. 
2. 
3. 


Designated Approving Authority 
Designated Accrediting Authority 
Delegated Accrediting Authority 


Discretionary Access Control 


Demand Assigned Multiple Access 


Director Central Intelligence Directive 


l. 
2. 


Defense Communications System 
Defense Courier Service 


Design Controlled Spare Part(s) 


Dual Driver Service (courier) 


Data Encryption Standard 


Directory Information Base 


Defense Information System Network 
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UNCLASSIFIED 


471 


472 


DITSCAP 


DoD TCSEC (C.F.D.) 


DLED (C.F.D.) 


DMA 


DMS 


DPL (C.F.D.) 


DSA 


DSN 


DSVT 


DTLS 


DTD 


DTS 


DUA 


EAM 


ECCM 


ECM 


ECPL 


EDAC 


EDESPL (C.F.D.) 


EDM (C.F.D.) 


EFD 


EFTO 


UNCLASSIFIED 


DoD Information Technology Security Certification 
and Accreditation Process 


Department of Defense Trusted Computer System 
Evaluation Criteria 


Dedicated Loop Encryption Device 
Direct Memory Access 
Defense Message System 


Degausser Products List (a section in the 
INFOSEC Products and Services Catalogue) 


Digital Signature Algorithm 

Defense Switched Network 

Digital Subscriber Voice Terminal 
Descriptive Top-Level Specification 
Data Transfer Device 

Diplomatic Telecommunications Service 
Directory User Agent 

Emergency Action Message 

Electronic Counter-Countermeasures 
Electronic Countermeasures 


Endorsed Cryptographic Products List 
(a section in the Information Systems 
Security Products and Services Catalogue) 


Error Detection and Correction 

Endorsed Data Encryption Standard Products List 
Engineering Development Model 

Electronic Fill Device 


Encrypt For Transmission Only 
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UNCLASSIFIED 


472 


473 


UNCLASSIFIED 


EGADS (C.F.D.) Electronic Generation, Accounting, and 


EKMS 


ELINT 


ELSEC (C.F.D.) 


E Model 


EMSEC (C.F.D.) 


EPL 


ERTZ 


ETL (C.F.D.) 


ETPL 


EUCI (C.F.D.) 


EV (C.F.D.) 
FDDI (c.F.D.) 
FDIU 

FIPS 

FOCI 

FOUO 
FSRS 

FSTS 


FTS 


GCCS 


Distribution System 

Electronic Key Management System 
Electronic Intelligence 

Electronic Security 

Engineering Development Model 
Emissions Security 


Evaluated Products List (a section in the 
INFOSEC Products and Services Catalogue) 


Equipment Radiation TEMPEST Zone 
Endorsed Tools List 
Endorsed TEMPEST Products List 


Endorsed for Unclassified Cryptographic 
Information 


Enforcement Vector 

Fiber Distributed Data Interface 

Fill Device Interface Unit 

Federal Information Processing Standard 
Foreign Owned, Controlled or Influenced 


For Official Use Only 


Functional Security Requirements Specification 


Federal Secure Telephone Service 
Federal Telecommunications System 
File Transfer Access Management 
Formal Top-Level Specification 

Global Command and Control System 
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UNCLASSIFIED 


473 


474 


GETS 


GPS 


GTS 


GWEN 


HDM (C.F.D.) 


HUS (C.F.D.) 


HUSK (C.F.D.) 


IA 


I&A 


IEMATS 


IFF 


IFFN 


IIRK (C.F.D.) 


ILS 


INFOSEC 


IO 


IP 


IPM 


IPSO 


IR (C.F.D.) 


IRK (C.F.D.) 


UNCLASSIFIED 


Government Emergency Telecommunications 


Service 

Global Positioning System 

Global Telecommunications Service 
Ground Wave Emergency Network 
Hierarchical Development Methodology 
Hardened Unique Storage 
Hardened Unique Storage Key 
Information Assurance 
Identification and Authentication 
Identity Based Access Control 
Interface Control Unit 

Intrusion Detection System 


Improved Emergency Message Automatic 
Transmission System 


Identification, Friend or Foe 
Identification, Friend, Foe, or Neutral 
Interarea Interswitch Rekeying Key 
Integrated Logistics Support 
Information Systems Security 
Information Operations 

Internet Protocol 

Interpersonal Messaging 

Internet Protocol Security Option 
Information Ratio 


Interswitch Rekeying Key 
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UNCLASSIFIED 


414 


475 


IS 


ISDN 


ISO 


ISS (C.F.D.) 


ISSE 


ISSM 


ISSO 


KDC 


KEK 


KG 


KMASE (C.F.D.) 


KMC 


KMID 


KMODC 


KMP 


KMPDU (C.F.D.) 


KMS 


KMSA (C.F.D.) 


KMUA (C.F.D.) 


KP 


UNCLASSIFIED 


Information System 

Integrated Services Digital Network 
International Standards Organization 
Information Systems Security 

Information Systems Security Engineering 
Information Systems Security Manager 
Information Systems Security Officer 
Information Technology 

International Traffic in Arms Regulation 


Information Technology Security Evaluation 
Criteria 


Key-Auto-Key 
Key Distribution Center 
Key Encryption Key 


Key Generator 


Key Management Application Service Element 


Key Management Center 


Key Management Identification Number 


Key Management Ordering and Distribution Center 


Key Management Protocol 

Key Management Protocol Data Unit 
Key Management System 

Key Management System Agent 

Key Management User Agent 

Key Processor 
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UNCLASSIFIED 


475 


476 


KPK 

KSD 

KSOS (C.F.D.) 
KVG (C.F.D.) 
LEAD 

LEAF (C.F.D.) 
LKG (C.F.D.) 
LMD 
LMD/KP 
LME (C.F.D.) 
LMI (C.F.D.) 
LOCK 

LPC 


LPD 


MATSYM (C.F.D.) 


MCCB (C.F.D.) 


MDC (C.F.D.) 


MEECN (C.F.D.) 


UNCLASSIFIED 


Key Production Key 

Key Storage Device 

Kernelized Secure Operating System 

Key Variable Generator 

Low-Cost Encryption/Authentication Device 
Law Enforcement Access Field 

Loop Key Generator 

Local Management Device 

Local Management Device/Key Processor 
Layer Management Entry 

Layer Management Interface 

Logical Co-Processing Kernel 

Linear Predictive Coding 

Low Probability of Detection 

Low Probability of Intercept 

Limited Rate Initial Preproduction 

Large Scale Integration 


1. Mandatory Access Control 
2. Message Authentication Code 


1. Mandatory Modification 
2. Metropolitan Area Network 


Material Symbol 
Modification /Configuration Control Board 
Manipulation Detection Code 


Minimum Essential Emergency Communications 
Network 
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UNCLASSIFIED 


476 


MEP (C.F.D.) 


MER 


MHS 


MI 


MIB 


MIJI (C.F.D.) 


MINTERM 


MISSI 


MLS 


MRT (C.F.D.) 


MSE 


NACAM 


NACSI 


NACSIM 


NAK 


NCCD 


NCS 


NCSC 


NISAC 


NIST 


NKSR (C.F.D.) 


NLZ 


NSA 


NSAD (C.F.D.) 


UNCLASSIFIED 


Management Engineering Plan 

Minimum Essential Requirements 

Message Handling System 

Message Indicator 

Management Information Base 

Meaconing, Intrusion, Jamming, and Interference 
Miniature Terminal 

Multilevel Information Systems Security Initiative 
Multilevel Security 

Miniature Receiver Terminal 

Mobile Subscriber Equipment 

National COMSEC Advisory Memorandum 
National COMSEC Instruction 

National COMSEC Information Memorandum 


Negative Acknowledge 


Nuclear Command and Control Document 


1. National Communications System 
2. National Cryptologic School 
3. Net Control Station 


National Computer Security Center 

National Industrial Security Advisory Committee 
National Institute of Standards and Technology 
Nonkernel Security Related 

No-Lone Zone 


National Security Agency 


Network Security Architecture and Design 
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UNCLASSIFIED 


471 


478 


NSD 


NSDD 


NSEP 


NSI 


NSO (C.F.D.) 


NSTAC 


NSTISSAM 


NSTISSC 


NSTISSD 


NSTISSI 


NSTISSP 


NTCB 


NTIA 


NTISSAM 


NTISSD 


NTISSI 


NTISSP 


OADR 


UNCLASSIFIED 


National Security Directive 

National Security Decision Directive 
National Security Emergency Preparedness 
National Security Information 


Network Security Officer 


National Security Telecommunications 
Advisory Committee 


National Security Telecommunications and 
Information Systems Security 
Advisory /Information Memorandum 


National Security Telecommunications and 
Information Systems Security Committe 


National Security Telecommunications and 
Information Systems Security Directive 


National Security Telecommunications and 
Information Systems Security Instruction 


National Security Telecommunications and 
Information Systems Security Policy 


Network Trusted Computing Base 


National Telecommunications and Information 
Administration 


National Telecommunications and Information 
Systems Security Advisory /Information 
Memorandum 


National Telecommunications and Information 
Systems Security Directive 


National Telecommunications and Information 
Systems Security Instruction 


National Telecommunications and Information 
Systems Security Policy 


Originating Agency’s Determination Required 
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UNCLASSIFIED 


478 


479 


OPCODE 


OPSEC 


ORA 


OTAD 


OTAR 


OTAT 


OTP 


OTT 


PAA 


PAAP (C.F.D.) 


PAE (C.F.D.) 


PAL 


PC 


PCA 


PCMCIA 


PCZ (C.F.D.) 


PDR 


PDS 


PDU (C.F.D.) 


PES 


PKA (C.F.D.) 


PKC 


PKI 


PKSD 


UNCLASSIFIED 


Operations Code 

Operations Security 
Organizational Registration Authority 
Over-the-Air Key Distribution 
Over-the-Air Rekeying 
Over-the-Air Key Transfer 
One-Time Pad 

One-Time Tape 

Policy Approving Authority 
Peer Access Approval 

Peer Access Enforcement 
Permissive Action Link 
Personal Computer 

Policy Certification Authority 


Personal Computer Memory Card International 
Association 


Protected Communications Zone 
Preliminary Design Review 


1. Protected Distribution Systems 
2. Practices Dangerous to Security 


Protocol Data Unit 
Positive Enable System 
Public Key Algorithm 
Public Key Cryptography 
Public Key Infrastructure 


Programmable Key Storage Device 
74 


UNCLASSIFIED 


479 


P model 
PNEK 


PPL 


PRBAC (C.F.D.) 
PROM 
PROPIN 

PSL (C.F.D.) 
PWDS 
RACE (C.F.D.) 
RAMP 

RQT (C.F.D.) 
SA 

SABI 

SAO 


SAP 


SARK 
SBU 
SCI 


SCIF 


SDNRIU (C.F.D.) 


SDNS 


SDR 


SFA 


SHA 


UNCLASSIFIED 


Preproduction Model 


Post-Nuclear Event Key 


Preferred Products List (a section in the INFOSEC 


Products and Services Catalogue) 
Partition Rule Base Access Control 
Programmable Read-Only Memory 
Proprietary Information 

Protected Services List 

Protected Wireline Distribution System 
Rapid Automatic Cryptographic Equipment 
Rating Maintenance Program 
Reliability Qualification Tests 

System Administrator 

Secret and Below Interoperability 
Special Access Office 


1. System Acquisition Plan 
2. Special Access Program 


SAVILLE Advanced Remote Keying 
Sensitive But Unclassified 


Sensitive Compartmented Information 


Sensitive Compartmented Information Facility 


Secure Digital Net Radio Interface Unit 
Secure Data Network System 

System Design Review 

Security Fault Analysis 


Secure Hash Algorithm 
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UNCLASSIFIED 


480 


481 


SFUG 


SI 


SIGSEC (C.F.D.) 


SISS 


SMU 


SPK 


SPS (C.F.D.) 


SRA (C.F.D.) 


SRR 


SSO 


SSP 


ST&E 


STE 


STS 


STU 


TA 


TACTED (C.F.D.) 


TACTERM 


TAG 


TCB 


TCD (C.F.D.) 


TCSEC (C.F.D.) 


TD (C.F.D.) 


TED 


TEK 


UNCLASSIFIED 


Security Features Users Guide 

Special Intelligence 

Signals Security 

Subcommittee on Information Systems Security 
Secure Mobile Unit 

Single Point Key(ing) 

Scratch Pad Store 

Sub-Registration Authority 

Security Requirements Review 

Special Security Officer 

System Security Plan 

Security Test and Evaluation 

Secure Terminal Equipment 

Subcommittee on Telecommunications Security 
Secure Telephone Unit 

Traffic Analysis 

Tactical Trunk Encryption Device 

Tactical Terminal 

TEMPEST Advisory Group 

Trusted Computing Base 

Time Compliance Data 

DoD Trusted Computer System Evaluation Criteria 
Transfer Device 

Trunk Encryption Device 


Traffic Encryption Key 
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UNCLASSIFIED 


481 


482 


TNI (C.F.D.) 


TNIEG (C.F.D.) 


UPP 

USDE (C.F.D.) 
V model (C.F.D.) 
VPN 


XDM/X Model 
(C.F.D.) 


UNCLASSIFIED 


TEMPEST Endorsement Program 
Trusted Facility Manual 

Traffic Flow Security 

Top-Level Specification 

Trusted Network Interpretation 


Trusted Network Interpretation Environment 
Guideline 


Two-Person Control 

Trusted Products Evaluation Program 
Two-Person Integrity 

Transmission Security 

Technical Review Board 

Tri-Service Tactical Communications System 
Technical Surveillance Countermeasures 
Telecommunications Security 
Transmission Security Key 

User Agent 

Unique Interswitch Rekeying Key 

User Interface System 

User Partnership Program 

Undesired Signal Data Emanations 
Advanced Development Model 


Virtual Private Network 


Experimental Development Model/Exploratory 


Development Model 
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UNCLASSIFIED 


482 


483 


UNCLASSIFIED 


SECTION III 
REFERENCES 


a. National Security Directive 42, National Policy for the Security of 
National Security Telecommunications and Information Systems, 5 July 1990. 


b. Executive Order 12958, National Security Information, dated 
29 September 1995. 


c. Executive Order 12333, United States Intelligence Activities, dated 
4 December 1981. 


d. Public Law 100-235, Computer Security Act of 1987, dated 8 January 
1988. 

e. 10 United States Codes Section 2315. 

f. 44 United States Code Section 3502(2), Public Law 104-13, Paperwork 


Reduction Act of 1995, dated 22 May 1995. 


g. Information Technology Management Reform Act of 1996 (within Public 
Law 104-106, DoD Authorization Act of 1996). 


h. NSA Information Systems Security Organization Regulation 90-16, dated 
29 October 1996. 
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UNCLASSIFIED 


483 
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CRM 1-499 + 
CRIMINAL RESOURCE MANUAL 
CRM 500-999 + 
CRM 2000 - 2500 
CRM 10001489 + 


2054. Synopsis Of Classified 
cvis + Information Procedures Act (CIPA) 


CRM 2000-2500 — =—— 


1. DEFINITIONS, PRETRIAL CONFERENCE, PROTECTIVE ORDERS AND DISCOVERY 
Criminal Resource _ After a criminal indictment becomes public, the prosecutor remains responsible tor taking 
Hames anni z0es: reasonable precautions against the unauthorized disclosure of classified information during 

the case, This responsibility applies both when the government intends to use classified 

2001. Coercion And information in its case-in-chief as well as when the defendant seeks to use classified 

Enticement (18 USC. information in his/her defense. The tool with which the proper protection of classifiad 

2422) information may be ensured in indicted cases is the Classified Information Procedures Act 

(CIPA), See Title 18, U.S.C. App Il 


2002. Transportation 


Fetal ari IPA is a procedural statute; it neither adds to nor detracts from the substantive rights of the 


defendant or the discoery obligations of the government. Rather, the procedure for makin 


iii these determinations is ditterent in that it balances the right of a criminal defendant with the 
right of the sovereign to know in advance of a potential threat from a criminal prosecution to 
Foi hni its national security. See, e.g., United States v, Anderson, 872 F.2d 1508, 1514 (11th Cir), cert, 
denied, 493 US. 1004 (198: Collins, 720 F.2d 1195, 1197 (1th Cir. 1983); 
United States v. Lopez-Lima, 738 F. Supp. 1404, 1407 (S.D.Fla. 1990). Each of CIPA's provisions 
2005. Motor Carrier is designed to achieve those dual eventing unnecessary or inadvertent disclosures 
Safety of classified information and advising the government of the national security "cost" of going 


Forward. 


PEER ERE A. Definitions of TermsSection 1 of CIPA defines “classified information" and "national 


security,” both of which are terms used throughout the statute. Subsection (a), in 
pertinent part, defines "classified information” as: 
2007. Railroad Satety—~ 1. {Alny information or material that has been determined by the United States 


Criminal Penalty 
Provisions 


tive or 


Government pursuant to an E statute, or regulation, to require 


protection against unauthorized disclosure for reasons of national security. 


Subsection (b) defines "national security” to mean the "national dafense and foreign 


SOS relations of the United States” 


— Civi Penalty 
Praida B, Pretrial Conference 

Section 2 provides thet “aft any time after the fling of the indictment or information, any 
anb Faan oie party may move for a pretrial conference to consider matters relating to classified 
Protection Statutes information that may arise in connection with the prosecution." Following such a motion, 


the district court "shall promptly hold a pretrial conference to establish the timing of 
requests for discovery, the provision of notice required by Section 5 of this Act, and the 
Initiation of the procedure established by Section 6 (to determine the use, relevance, or 


admissibility of classified information) of this Act.” 


2010. Occupational 
Safety And Health Act 


2011, OSHA -Criminal C. Protective Orders 

Violations Of critical importance in any criminal case, once there exists any likelihood that classified 
information may be at issue, is the entering of a protective order by the district court 
CIPA Section 3 requires the court, upon the request of the government, to issue an order 
to protect against the disclosure of any classified information disclosed by the United 


2012. OSHA -Willful 
Violation OF A Satety 


Standard Which States to any defendant in any criminal case.” The government's motion for a protective 
Causes Death To An order is an excellent opportunity to begin educating the Court, including the judge's staff, 
Employes about CIPA and related issues, Its essential that the motion include a memorandum of 
law that provides the court with an overview on national security matters and sets forth 
So OSAN. the authority by which the government may protect matters of national security. including 
Unauthorized Advance the general authority of the intelligence Community (IC) pursuant to the National Security 


Notice OF Inspection 


ot of 1947, the Central Intelligence Act of 1949, and various Executive orders issued by 
the President, For sample mations and protective orders or to discuss any problems you 
may have with the court on CIPA issues, please contact the ISS, The protective order must 


2014, 0SHA—False 


piace be sufficiently comprehensive to ensure that access to classitied information is restricted 
Representation, Or to cleared persons and to provide for adequate procedures and facilities for proper 
Certification handling and protection of classified information during the pre-trial litigation and trial of 


the case. 


2015. OSHA~Civil 


Pskov et ‘The requirement of security clearances does not extend to the judge or to the defendant 


(who would likely be ineligible, anyway). Some defense counsel may wish to resist this 


2016. Federal Mine regulations, statutes, and Executive Orders upon the disclosure of classified information, 


Security Officer (CS0). The CSO is an employee of the Department's Justice Management 
Division; however, the court's appointment of a CSO makes that person an officer of the 


2018. MSHA Willful 


hraa court. In that capacity, the CSO is responsible for assisting both parties and the court 
Mandatory Health Or staff in obtaining security clearances (not required for the judge); in the proper handling 
Satety Standard Or and storage of classified information, and in operating the special communication 


Withdrawal Order 


‘equipment that must be used in dealing with classified information, 


D. Discovery of Classified Information by Defendant 
ction 4 provides in pertinent part that "[t]he court, upon a sufficient showing, may 
authorize the United States to delete specified items of classified information trom 
documents to be made available to the defendant through discovery under the Federal 
Rules of Criminal Procedure, to substitute a summary of the information for such 


2019. MSHA 
Unauthorized Advance 
Notice OF Inspection 


Sanimi- Fali classified documents, or to substitute a statement admitting the relevant facts that 
tatement, 


Representation. Or 
Certification Criminal Procedure, section 4 provides that the Government may demonstrate that the 


Use of such alternatives is warranted in an in camera, ex parte submission to the court. 


classified information would tand to prove.” Like Rule 16(¢)(I) of the Fadaral Rules of 


2021. MSHA By the time of the section 4 proceeding, the prosecutor should have completed the 
panman rgd government’ review of any classified material and have identified any such material that 
Pocket is arguably subject to the government's discovery obligation. Where supported by Law. the 
Novices prosecutor, during the proceeding, should first strive to have the court exclude as much 
classified information as possible from the government's discovery obligation. Second, to 
the extent that the court rules that certain classified material is discoverable, the 
Paha prosecutor should seek the court's approval to utilize the alternative measures described 


In section 4, ie., unclassified summaries and/or stipulations, The court's denial of such a 
request is subject ta interlocutory appeal. See Section ILA, infra. 


Enforcement 


Sees Viani ‘| SECTIONS 5 AND 6: NOTICE AND PRETRIAL EVIDENTIARY RULINGS: 
NOTICE OF INTENT TO USE CLASSIFIED INFORMATION 


‘Seasonal Agricultural 
Worker Protection Act 


Following the discovery process under section 4, thare ara three critical pretrial steps in the 


handling of classified information une one 5 and 6 of CIPA. First, the defendant must 
2024. Migrant And specify in detail, in a written notice, the precise classified Information he reasonably expects 
Seasonal Agricultural to disclose. Second, the Court, upon a mation of the Government, shalt hold a hearing 


Worker Protection Act pursuant to section (a) to determine the use, relevance and admissibility of the proposed 
Referrals From vidence. Third, following the 6(a) hearing and formal findings of admissibility by the Court 
Department Of Labor the Government may move to substitute redacted versions of classified documents from the 
originals or to prepare an admission of certain relevant facts or summaries for classified 

information that the Court has ruled admissible. 


2025. Provisions Of 
The Migrant And A. The Section 5{a) Notice Requirement 
Seasonal Agricultural PRETRIAL EVIDENTIARY HEARING, SUBSTITUTIONS AND STIPULATIONS. 
Worker Protsetion Act 
The linchpin of CIPA is section Sa), which 
disclose (or cause the disclosure af) 


vires a defendant who reasonably intends to 

ified information to provide timely pretrial 

2026, Enforcement written notice of his intention to the Court and the Government. Section 5(a) expressly 
requires that such notice “Include a brief description of the classified information,” and 

ie leading case under section 5(a) holds that such notice 


2027. Mann Act 


3 ng forth specifically the classified information which the 
jas to be nacessary to his defense. 

2028. Bank Records 

And Foreign United States v. Collins, 720 F.2d 1195, 1199 (11th Gir. 1983) (emphasis added) See also 

‘Transactions Act United States v. Smith, 780 F.2d 1102, 105 (4th Cir, 1985) (en banc]. This requirement 


applies both to documentary exhibits and to oral testimony, whether itis anticipated to be 


RETE EA brought out on direct or on cross-examination. See, e.g., United States v. Collins, supra, 


peasant (tostimony); United States v. Wilson, 750 F:2d 7 (2d Cir. 1984) (same), 
Foreign Transactions, 
ho If adefendant fails to provide a sufficiently detailed notice far enough in advance of trial 


to permit the implementation of CIPA procedures, section S(b) provides far preclusion, 
See United States v. Badia, 827 F.2d 1458, 1465 (ith Cir. 1987]. Similarly, it the defendant 
attempts to disclose at trial classified information which is not described in his/her 

section Sla) notice, preclusion is the appropriate remedy prescribed by section 5(b) of the 
statute. SeeUnited States v. Smith, supra, 780 F.2d at T105 ("A defendant is forbidden from 


2030. Reports On 
Domestic Financial 
‘Transactions 


disclosing any such information absent the giving of notice") 
2021. Reports On The 

Export And Import Of B. The Section 6(a) Hearing 

Monetary Instruments The purpose of the hearing pursuant to section 6(a) of CIPA is for the court "to make all 


determinations concerning the use, relevance, or admissibility of classified information 
PRAE that would otherwise be made during the trial..." 18 U.S.C. App. I1 5 lal, The statute 
Foreign Financial expressly provides that, after a pretrial section Gla] hearing on the admissibility of 
Agency Transactions evidence, the court shall enter its rulings prior to the commencement of trial. f the 
Attorney General or his/her designee certifies to the court in a petition that a public 
proceeding may result in the disclosure of classified information, then the hearing will be 
held in camera, CIPA does not change the "generally applicable evidentiary rules of 
admissibility.” United States v. Wilson, supra 750 F.2d at 9. but rather alters the timing of 
2034, Sample rulings 2s to admissibility to require them to be made before the trial. Accord, United 


Instruction Elements States v. Smith, supra, 780 F.2d at 1106. 
OF SIUSC. 5324343) 


2023, Structuring 


At the section la) hearing, the court is to hear the defense proffer and the arguments of 
counsel, and then rule whether the classified information identified by the defense is 
relevant under the standards of Fed.R.Evid. 401. United States v. Smith, supra, 780 F.2d at 
1106. The court's inquiry does not end there, for under Fed.R.Evid, 402, not all relevant 
evidence is admissible at trial. The Court therefore must also determine whether the 
evidence is cumulative, prejudicial, confusing, or misleading," United States v. Wilson, 


2035. Use OF Other 
Criminal Stat 


2036. Civil Remedies- 


injunctions 
á supra, 750 F:2d at 9, co that it should be excluded under Fed.R.Evid. 403. 
SOTOA Remedies At the conclusion of the section 6 (a) hearing, the court must state in writing the reasons 
Civil Penalties for its determination as to each item of classified information. 18 US.C. App. il section 
5la). 


2038. Exemptions 


‘Substitution Pursuant to Section 6le) 
If the court rules any classified information to be admissible, section 6(c} of CIPA permits 
the Government to propose unclassified "substitutes" for that information. Specifically, 
the Government may move to substitute either (1) a statement admitting relevant facts 


2039. Bank Records 


And Foreign 
“Transactions that the classified information would tend to prove or (2) a summary of the classified 
Dissemination OF Information instead of the classified information itself. 18 U.S.C. App. IlI section 6(c)(0), 


Financial information ‘See United States v. Smith, supra, 780 F.2d at 1105. In many cases, the government will 


propose a redacted version of a classified document as a substitution for the original, 
2040. Bank Records having deleted only non-relevant classified information, A motion for substitution shall be 
‘And Foreign granted if the "statement or summary will provide the defendant with substantially the 
Transactions me ability to make his defense as would disclosure of the specified classified 


Financial Crimes h 
information.” 18 US.C. App. IN section 6() 
Enforcement Network neem eee ete ES 


quoe If the district court will not accept a substitution proposed by the government, an 
interlocutory appeal may lie to the circuit court under CIPA section 7. If the issue is 

2041, Bribery Of Public resolved against the government, and classified information is thereby subject toa 

Officials disclosure order of the court, the AUSA must immediately notify the ISS. Thereafter, the 
Attorney General may file an affidavit effectively prohibiting the use of the contested 

PERA classified information. If that is done, the court may impose sanctions against the 

Common To Both government, which may include striking all or part of a witness’ testimony, resolving an 

Bribery And Gratuity \ssue of fact against the United States, or dismissing part or all of the indictment. See 

Offenses CIPA section Ge). The purpose of the relevance hearings under @(a) and the substitution 
practice under 6(c), however, is ta avoid the necessity for these sanctions. 

2042. Comparison Of + OTHER RELEVANT CIPA PROCEDURES 

The Elements Ot The 

Crimes Of Bribery And A. interlocutory Appeal 


Gratuities APPEAL FROM INTERLOCUTORY ORDER 


2044. Particular 
Elements 


2045. U.S. V. Brewster 


2046. Other lesues 


2047, Sample 
Charging Language 


2048. January 23, 
1992, Memorandum 
Directing US. Attys To 
Designate A 
Prosecutor As An 
International And 
National Security 
Coordinator 


2049. September 21. 
1994, Memorandum 
From Deputy Atty 
General Concerning 
Requirement Ot 
Consultation On 
‘National Security 
Issues 


2050. May 5, 1995, 
Memorandum Fram 
Deputy Atty Genaral 
Concerning Provision 
Of National Security 
Information To Judges 
And Staff And Use OF 
Inrellizence Agency 
Attys 


2051, May 5. 1995, 
‘Memorandum From 
Deputy Atty General 
Concerning Focal 
Points For Initial 
Contacts With 
Intelligence 
Community In Criminal 
Cases 


2052, Contacts With 
The Intelligence 
Community Regarding 
Criminal Investigations 
Or Prosecutions 


2053. Disclosure OF 
Grand Jury Information 
To An Intelligence 
Agency 


2054. Synopsis Of 
Classified Information 
Procedures Act (CIPA) 


2055. Public Authority 
Defense 


2056, Preparation Of 
Witnesses Whose 

‘Testimony May Involve 
Classified Information 


2057. Synapses Of 
Kev National Defense 
And Nationel Security 
Provisions 


2058. Atomic Eneray 
Act 


2059. Synopses Of 
Key Internal Security 
Provisions 


2060, Overseas 
Investigations Of 
Export Control— 
Related Cases 


2064, Conflict OF 
Interest. Cheater 11 Of 
Title 18, US. Code 


2067, Voorhis Acti — 
1@USC.§ 2386 


2068. Registration Of 
Persons With 
Knowledge OF 
Espionaze--50 USC, 
85170857 


2069. Political 
Contributions By 
Foreign Nationals 2 
USG.4¢e 


2070. Considerations 
Prior To Seeking 
Indictment- 
Commentary 


2071.RicO 
Prosecution 
Memorandum- 
Preface 


2072. RICO 
Prosecution 
Memorandum 
Purpose 


2073. RICO 
Prosecution 
‘Memorandum. 
General Requirements 


2074, RICO 
Prosecution 
Memorandum- 
Identification OF The 
Datendants 


2075.RiCO 
Prosecution 
Memorandum--A 
Statement Of 
Proposed Charges 


2076.RiCO 
Prosecution 
‘Memorandum. 
‘Summary Of The Casa 


2077. RICO 
Prosecution 
Memorandum— 
Statement Of The Law 


2078. RICO 
Prosecution 
Memorandum 
‘Statement Of Facts- 
Proof OF The Offense 


2079. RICO 
Prosecution 
Memorandum 
Anticipated 
Datansas/Spacial 
Problems Or 
Considerations 


2080, RICO 
Prosecution 
Memorandum— 
Forfeiture 


2081. RICO 
Prosecution 
Memorandum—RICO 
Policy Section 


2082. RICO 
Prosecution 
Memorandum- 
Conclusion 


2083. RICO 
Prosecution 
Memorandum— 
Proposed Indictment— 
Finat Draft 


2084. Restraining 
Orders 


2085. Syndicated 
Gambiing 


2086. Loansharking, 


2087, Loansharking 
Basis For Federal 
Jurisdiction 


2088. Loansharking— 
Scops Of Federal 
Jurisdiction 


2089. The Gambling 
Ship Act (1BUSC. 
1081, Et Sea) 


2080. RICO And VCAR 
Manuals 


ESS Sete EEEE EATA wa) Sa eee Ry Spee ey meee B eeemer EE: 
decision or order of the trial judge authorizing the disclosure of classified information, 
imposing sanctions for nondisclosure of classified information, or refusing a protective 
order sought by the United States to prevent the disclosure of classified information, 
Section 7 appeals must be approved by the Solicitor General. The term “disclosure” within 
the meaning of section 7 includes both information which the court orders the 
government to divulge to the defendant or to others as well as information already 
possessed by the defendant which he or she intends to disclose to unapproved people. 
Section 7(b) provides that the court of appeals shall give expedited treatment to any 
interlocutory appeal filed under subsection (2). As a matter of fairness, the policy of the 
Department shall be that the defense be given notice of the government's appeal under 
section 7 


B. Introduction of Classified information 
Section 8a) provides that "writings, recordings, and photographs containing classified 
information may be admitted into evidence without change in their classification statu 
‘This provision simply recognizes that classification is an executive, not a judicial, function, 
Thus, section 8(a) implicitly allows the classifying agency, upon completion of the trial, to 
decide whether the information has been so compromised during trial that it could no 
longor be regarded as classified 


In order to prevent ‘unnecessary disclosure” of classified information, section 8(b) 
permits the court to order admission into evidence of only a part at a writing, recording, or 
photograph, Alternativaly, the court may order into evidence the whole writing, 
recordings, or photograph with excision of all or part of the classified information 
contained therein, However, the provision does not provide grounds for excluding or 
excising part of a writing or recorded statement which ought in fairness to be considered 
contemporancously with it. Thus, the court may admit into evidence part of a writing, 
recording, or photograph only when fairness does not require the whole document to be 
considered. 


Section 8(c) provides a procedure to address the problem presented during a pretrial or 
‘rial proceeding when the defendant's counsel asks a question or embarks on a line of 
inquiry that would require the witness to disclose classified information not previously 
found by the court to be admissible. If the defendant knew that a question or line of 
Inquiry would result in disclosure of classified information, he/she presumably would have 
given the government notice under section 5 and the provisions of section G(a) would 
have been used, Section Blc) serves, in effect, as a supplement to the hearing provisions 
of section 6(@} to cope with situations which cannot be handled effectively under that 
section, e.g., where the defendant does not realize that the answer to a given question 
will reveal classified information. Upon the government's objection to such a question, the 
court is required to take suitable action to avoid the improper disclosure of classified 
Information. 


C. Security Procedures, 
Section 9 required the Chief Justice of the United States to prescribe security procedures 
for the protection of classified information in the custody of Federal courts. On February 
12, 1981, Chief Justice Burger promulgated these procedures. For further information 
regarding those procedures, please contact the Justice Management Division Office of 
Security. (202) 514-2094, 


D. Public Testimony By Intelligence Officers 
Although the IC is committed to assisting law enforcement whera it is legally proper to do 
50, it must also remain vigilant in protecting classified national security information from 
unauthorized disclosure. Just as with law enforcement agencies, the successful 
functioning of the IC turns in significant part upon the ability of its intelligence officers 
covertly to obtain information from human sources. In carrying out that task, the 
intelligence officers must, when necessary, be able to operate anonymously, that is, 
without their connection to an intelligence agency of the United States being known to 
the persons with whom they come in contact. For that reason, en intelligence agency is 
authorized under Executive Order 12958 to classify the true name of an intelligence 
officer. 


During the pre-trial progression of an indicted case, as the court enters its CIPA rulings 
Under sections 4 and 6, it may become apparent to the prosecutor that testimony may be 
required from an intelligence officer or other agancy representative engaged in covert 
activity, either because the Court has ruled under CIPA that certain evidence is relevant 
and admissible in the defense case, or because such testimony is necessary in the 
government's rebuttal. Just as the substance of that testimony, to the extent it is 
classified and is being offered by the defense, must be the subject of CIPA 
determinations by the court, the prosecutor must also ensure that the same 
considerations are afforded to the true names of covert intelligence community 
personnel, if those true names are classified information. That is, the prosecutor must 
seek the court's approval, under either CIPA section 4 or section 6, of an alternative 
method to the witness’ testimony in true name that will provide the defendant with the 
same ability that he would have otherwise had to impeach, or bolster, the credibility of 
that witness. 


In any criminal case in which it becomes likely that an intelligence agency employee will 
testify, the Assistant United States Attorney (AUSA) assigned to the case shall 
immediately notify the Internal Security Section (ISS). That office, in consultation with the 
general counsel at the appropriate intelligence agency, will assist the AUSA during 
pretrial motion practice and litigation on the issue of whether the witness should testity in 
trua name and other issues related to the testimony of intelligence agency personnel. 


[cited in JM 9-80 240) 
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Course Introduction 


Welcome to Unauthorized Disclosures of Classified Information. This course identifies and discusses 
employee's responsibilities for safeguarding classified information against unauthorized disclosures. This 
course also outlines the criminal and administrative sanctions which can be imposed for an unauthorized 
disclosure, While there sre multiple categories of unauthorized disclosures, this course will focus on 
unauthorized disclosures to the media due to the significance of the damage these leaks have caused to 
both the Intelligence Community (IC) and national security. 


The bottom line is that when a cleared employee improperly discloses classified information, they risk 
damaging the nation and themselves, 


Damage to Nation Harm to Individual 


* Damages national security * Revocation of security clearance 


* Damages IC capabilities Termination of employment 
* Impacts IC's ability to perform its mission * Criminal prosecution and associated 
* Benefits adversaries wishing to harm the penalties 
United States (U.S.) Loss a pension and other retirement 
benefits 


An additional course, Unauthorized Disclosures of Classified Information - Supplement for Security 
Professionals, will provide security professionals and thelr managers with additional training on security 
professional-specific topics regarding unauthorized disclosures, 


Course Introduction 

Welcome to Unauthorized Disclosures of Classified Information. This course identifies and discusses 
employees’ responsibilities for safeguarding classified information against unauthorized disclosures. This 
course also outlines the criminal and administrative sanctions which can be imposed for an 
unauthorized disclosure. While there are multiple categories of unauthorized disclosures, this course 
will focus on unauthorized disclosures to the media due to the significance of the damage these leaks 
have caused to both the Intelligence Community (IC) and national security. 


The bottom line is that when a cleared employee improperly discloses classified information, they risk 
damaging the nation and themselves. 


Damage to Nation | Harm to Individual 
Damage to national security e Revocation of security clearance 
Damage to IC capabilities e Termination of employment 


Impact IC’s ability to perform its mission e Criminal prosecution and associated penalties 
Benefit adversaries wishing to harm the United e Loss of pension and other retirement benefits 
States (U.S.) 


An additional course, Unauthorized Disclosures of Classified Information — Supplement for Security 
Professionals, will provide security professionals and their managers with additional training on security 
professional-specific topics regarding unauthorized disclosures. 
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Course Organization 


Unauthorized Disclosures of Classified Information ts organized into three different lessons with various 
Supporting subtopics and activities: 


Lesson 1; Defining Unauthorized Disclosures (5 minutes) 
+ Define unauthorized disclosures 
* Identify the legal authorities for the Executive Branch to withhold information in the interest of 
national security 


Lesson 2: Harm Resulting from Unauthorized Disclosures (10 minutes) 
+ Describe the damage caused by unauthorized disclosures 


Lesson 3; Misconceptions and Employee Responsibilities 
3.1 Misconceptions Related to Unauthorized Disclosures (5 minutes) 
* Identify misconceptions IC employees may have associated with unauthorized disclosures 


3.2 Employee Responsibilities and Accountability (10 minutes) 
* Identify employee responsibilities, accountability, and reporting requirements associated with 
unauthorized disclosures 


Course Organization 
Unauthorized Disclosures of Classified Information is organized into three different lessons with various 
supporting subtopics and activities: 


Lesson 1: Defining Unauthorized Disclosures (5 minutes) 
e Define unauthorized disclosures 
e Identify the legal authorities for the Executive Branch to withhold information in the interest of 
national security 


Lesson 2: Harm Resulting from Unauthorized Disclosures (10 minutes) 
e Describe the damage caused by unauthorized disclosures 


Lesson 3: Misconceptions and Employee Responsibilities 
3.1 Misconceptions Related to Unauthorized Disclosures (5 minutes) 
e Identify misconceptions IC employees may have associated with unauthorized disclosures 


3.2 Employee Responsibilities and Accountability (10 minutes) 
e Identify employee responsibilities, accountability, and reporting requirements associated with 
unauthorized disclosures 
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Lesson 1: Defining Unauthorized Disclosures 
(Approximately 5 minutes) 
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Lesson 1.1: Introduction and Objectives 


When working with sensitive information, it is critical that you understand what is and is not appropriate 
to share and with whom you can share it. In the Defining Unauthorized Disclosures topic, you will learn 
to differentiate classification levels and identify who is authorized to receive classified information 


Objectives 
* Define unauthorized disclosures 
* List the requirements necessary to become an authorized recipient 
* Describe classification levels 


Lesson 1.1: Introduction and Objectives 

When working with sensitive information, it is critical that you understand what is and is not appropriate 
to share and with whom you can share it. In the Defining Unauthorized Disclosures topic, you will learn 
to differentiate classification levels and identify who is authorized to receive classified information. 


Objectives 
e Define unauthorized disclosures 
e List the requirements necessary to become an authorized recipient of classified information 
e Describe classification levels 


(Image Alt: Three unknown men sitting in chairs) 
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Lesson 1.1: Unauthorized Disclosures Defined 


Executive Order (FEO) 13526, signed by President Obama 
in 2009, is the current policy document codify ing the 
policies and procedures for identifying and safeguarding 


classified information Authorized 
EO 13526, Section 6. 1(rr) defines unauthorized Recipient 


disclosure as: 


"A communication or physical transfer of classified 
information to an unauthorized recipient ¥ 
An individual is categorized as an authorized recipient if 
he or she meets the three criteria identified by EO 13526, 


Section 4,1 (a). An authorized recipient must: 
+ Obtain a favorable determination of eligibility for —_ 
access ~ 
* Execute an approved Non-disclosure Agreement el \ k 
(NdA) ye) if 4 
* Possess a "need-to-know” for the classified E 


information 


Anyone that does not meet the three criteria described 
above is an unauthorized recipient. Unauthorized 
recipients may include representatives from: 
Foreign intelligence services 
* Media outlets 


Lesson 1.1: Unauthorized Disclosures Defined 
Executive Order (EO) 13526, signed by President Obama in 2009, is the current policy document 
codifying the policies and procedures for identifying and safeguarding classified information. 


EO 13526, Section 6.1 (rr) defines authorized disclosure as: 


Quote: 
"A communication or physical transfer of classified information to an unauthorized recipient.” 


An individual is categorized as an authorized recipient if he or she meets the three criteria identified by 
EO 13526, Section 4.1 (a). An authorized recipient must: 

e Obtain a favorable determination of eligibility for access 

e Execute an approved Non-disclosure Agreement (NdA) 

e Possess a “need-to-know” for the classified information 


Anyone that does not meet the three criteria described above is an unauthorized recipient. 
Unauthorized recipients may include representatives from: 

e Foreign intelligence services 

e Media outlets 


(Image Alt: Three criteria for an authorized recipient — “Eligibility” is a thumbs-up, “Requirement” is a 
“Need-to-Know” key on a keyboard, and “Agreement” is a signature on an NdA.) 
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Lesson 1.1: EO 13526 - Classification Levels 


The classification level for intelligence information is based specifically on the level of damage to 
national security that would occur if the information were disclosed to an unauthorized person. 


Information Is classified 35 TOP SECRET if an unauthorized disclosure could reasonably be expected to 
couse exceptionally grave damage to national security 


Information is classified as SECRET if an unauthorized disclosure could reasonably be expected to 
cause serious damage to national security 


Information is classified ss CONFIDENTIAL If an unauthorized disclosure could reasonably be expected 
to cause damage to national security 


Unauthorized disclosures, 
as defined in the NdA, carry 
the same penalties 
regardless of the 
classification level. It is also 
critical to understand that 
Information that is 
“unclassified” does not 
automatically mean that it 
is publicly releasable. Some 
unclassified material may 
be especially sensitive, the 
handling of which is 
governed by other U.S, 
laws (@.g., Privacy Act, 
litigation, etc.) 


Lesson 1.1: EO 13526 - Classification Levels 
The classification level for intelligence information is based specifically on the level of damage to 
national security that would occur if the information were disclosed to an unauthorized person. 


Information is classified as TOP SECRET if an unauthorized disclosure could reasonably be expected to 
cause exceptionally grave damage to national security. 


Information is classified as SECRET if an unauthorized disclosure could reasonably be expected to cause 
serious damage to national security. 


Information is classified as CONFIDENTIAL if an unauthorized disclosure could reasonably be expected to 
cause damage to national security. 


Unauthorized disclosures, as defined in the NdA, carry the same penalties regardless of the classification 
level. It is also critical to understand that information that is “unclassified” does not automatically mean 
that it is publicly releasable. Some unclassified material may be especially sensitive, the handling of 
which is governed by other U.S. laws (e.g., Privacy Act, litigation, etc.). 


(Image Alt: A collage of three classified documents, an American flag, and a face.) 
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Lesson 1.1: Intelligence Community Responsibilities 


To further clarify the responsibilities of the IC 
regarding the safequarding of National Security 
Information (NSI), Intelligence Community Directive 
(ICD) 701 of 2007 details the policy of the Office of 
the Director of National Intelligence (ODNI) to 
identify, report, and investigate unauthorized 
disclosures. The ICD also addresses IC agencies’ 
responsibility to take corrective action when a 
disclosure occurs, 


The specific criteria identified in ICD 701 will be 
addressed in further detail in the Unauthorized 
Disclosures of Classified Information - Supplement for 
Security Professionals course. 


Lesson 1.1: Intelligence Community Responsibilities 

To further clarify the responsibilities of the IC regarding the safeguarding of National Security 
Information (NSI), Intelligence Community Directive (ICD) 701 of 2007 details the policy of the Office of 
the Director on National Intelligence (ODNI) to identify, report, and investigate unauthorized 
disclosures. The ICD also addresses IC agencies’ responsibility to take corrective action when a disclosure 
occurs. 


The specific criteria identified in /CD 701 will be addressed in further detail in the Unauthorized 
Disclosures of Classified Information - Supplement for Security Professionals course. 


(Image Alt: A collage of a man holding a clipboard and a checklist.) 
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Lesson 1.1: Knowledge Check 


An unauthorized disclosure is defined as a communication or physical transfer of classified 
information to an unauthorized recipient. 


Select the correct response and select SUBMIT. 


© True 


O False 


1. An unauthorized disclosure is defined as a communication or physical transfer of classified 
information to an unauthorized recipient. 


Select the correct response and select SUBMIT. 
a) True 
b) False 
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Correct Response: 
True 


Feedback when correct: 
That's right! You selected the correct response. 


Unauthorized disclosure is defined by Executive Order (EO) 13526, Section 6.1(rr). 


Feedback when incorrect: 
You did not select the correct response. The correct response is True. 


Unauthorized disclosure is defined by Executive Order (EO) 13526, Section 6.1(rr). 
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What criteria must an individual meet in order to be considered an authorized recipient? 


Select all that apply and select SUBMIT. 


Win a classified government contract 
Execute an approved Non-disclosure Agreement (NdA) 
Possess a "need to know" for the classified information 


Obtain favorable determination of eligibility for access 


2. What criteria must an individual meet in order to be considered an authorized recipient? 


Select all that apply and select SUBMIT. 
a) Winaclassified government contract 
b) Execute an approved Non-disclosure Agreement (NdA) 
c) Possess a "need to know" for the classified information 
d) Obtain favorable determination of eligibility for access 
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Correct Responses: 
b) Execute an approved Non-disclosure Agreement (NdA) 
c) Possess a "need to know" for the classified information 
d) Obtain favorable determination of eligibility for access 


Feedback when correct: 
That’s right! You selected the correct responses. 


Feedback when incorrect: 
You did not select the correct responses. 


An authorized recipient must first: 
e Obtain favorable determination of eligibility for access 
e Possess a "need to know" for the classified information 
e Execute an approved Non-disclosure Agreement (NdA) 
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Complete the following statement for each of the classification levels. 


If information is disclosed to an unauthorized recipient, it could reasonably 
be expected to cause to national security. 


Drag the correct result to each classification level and select SUBMIT. 


CONFIDENTIAL damage 


SECRET serious damage 


TOP SECRET exceptionally grave damage 


3. Complete the following statement for each of the classification levels. 


If information is disclosed to an unauthorized recipient, it could reasonably be 
expected to cause to national security. 


Drag the correct result to each classification level and select SUBMIT. 


Classification Levels: 
a) CONFIDENTIAL 
b) SECRET 
c) TOP SECRET 


Results: 
a) damage 
b) exceptionally grave damage 
c) serious damage 
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Correct Responses: 
If CONFIDENTIAL information is disclosed to an unauthorized recipient, it could reasonably be expected 
to cause damage to national security. 


If SECRET information is disclosed to an unauthorized recipient, it could reasonably be expected to cause 
serious damage to national security. 


If TOP SECRET information is disclosed to an unauthorized recipient, it could reasonably be expected to 
cause exceptionally grave damage to national security. 


Feedback when correct: 
That’s right! You selected the correct responses. 


Feedback when incorrect: 
You did not select the correct responses. 


The correct responses are: 
If CONFIDENTIAL information is disclosed to an unauthorized recipient, it could reasonably be expected 
to cause damage to national security. 


If SECRET information is disclosed to an unauthorized recipient, it could reasonably be expected to cause 
serious damage to national security. 


If TOP SECRET information is disclosed to an unauthorized recipient, it could reasonably be expected to 
cause exceptionally grave damage to national security. 
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Lesson 1: Summary 


Sharing classified information with an 
individual who is not authorized to 
receive itis considered an unauthorized 
disclosure. You are responsible for 
safeguarding classified information. 
This means that you must be diligent 
about protecting inforrnation and 
identifying and immediately reporting 
any issues to the appropriate official in 
your agency or company. 


There are three classification levels 
based on the level of darnage to 
national security that would occur if the 
Information were disclosed to an 
unauthorized person. It is vital that you 
understand your agency's requirements 
Involving the transfer or release of 
National Security Information (NSI). 


Now that you understand the definition 
of an unauthorized disclosure and your 
responsibilities for safeguarding 
classified NSI, let us explore the 
damage that is caused when an 
unauthorized disclosure occurs. 


Lesson 1: Summary 

Sharing classified information with an individual who is not authorized to receive it is considered an 
unauthorized disclosure. You are responsible for safeguarding classified information. This means that 
you must be diligent about protecting information and identifying and immediately reporting any issues 
to the appropriate official in your agency or company. 


There are three classification levels based on the level of damage to national security that would occur if 
the information were disclosed to an unauthorized person. It is vital that you understand your agency’s 
requirements involving the transfer or release of National Security Information (NSI). 


Now that you understand the definition of an unauthorized disclosure and your responsibilities for 
safeguarding classified NSI, let us explore the damage that is caused when an unauthorized disclosure 
occurs. 


(Image Alt: Various security measures (e.g., security sticker, security guard, cipher lock, shredded paper, 
circuit board.)) 
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Lesson 2: Harm Resulting from Unauthorized Disclosures 
(Approximately 10 minutes) 
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Lesson 2.1: Introduction and Objective 


It is critical that you are aware of the impact unauthorized disclosures can have on the IC's ability to 
provide timely and actionable intelligence in support of national security objectives. There are many 
different types of unauthorized disclosures, including data spills, but this topic focuses on unauthorized 
disclosures to the media (referred to here as leaks) due to the significance of the damage they have 
caused, 


There are six identifiable categories of damage associated with media leaks. These categories, which 
can also be applied to other unauthorized disclosures, include. 

* Potential Loss of Life 

+ Damage to Sources and Methods 

* Effect on International Alliances 

* Financial Costs 

+ Impact to Foreign Policy 

* Misinforming or Distorting Public Perception 


As the categories imply, unauthorized disclosures have cost the U.S. valuable information, hundreds of 
millions of dollars, and in some cases, lives. 
Objective 

+ Identify the six categories of damage 


“Ensure the workforce understands the impact that 
unauthorized disclosures have on organizations’ missions 
and national security, . ~ 


- ICD 701, Section G4) 


Lesson 2.1: Introduction and Objective 

It is critical that you are aware of the impact unauthorized disclosures can have on the IC’s ability to 
provide timely and actionable intelligence in support of national security objectives. There are many 
different types of unauthorized disclosures, including data spills, but this topic focuses on unauthorized 
disclosures to the media (referred to here as leaks) due to the significance of the damage they have 
caused. 


There are six identifiable categories of damage associated with media leaks. These categories, which can 
also be applied to other unauthorized disclosures, include: 

e Potential Loss of Life 

e Damage to Sources and Methods 

e Effect on International Alliances 

e Financial Costs 

e Impact to Foreign Policy 

e Misinforming or Distorting Public Perception 


As the categories imply, unauthorized disclosures have cost the U.S. valuable information, hundreds of 
millions of dollars, and in some cases, lives. 


Objective 
e Identify the six categories of damage 


Call Out Box: 
“Ensure the workforce understands . . . the impact that unauthorized disclosures have on organizations’ 
missions and national security. . .” 

~ICD 701, Section G(4) 
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Lesson 2.1: Identifying Damage 


In 2005, the results of the Weapons of Mass 
Destruction (WMD) Commission were presented to 
President Bush, The WMD Commission had been 
charged with investigating IC deficiencies, especially 
those related to intelligence regarding Iraq and their 
WMD program, The UNCLASSIFIED final WMD 
Commission Report identified several concerns, 
including the harm caused by unauthorized 
disclosures, 


“The scope of damage done to our collection 
capabllities from media disclosures of classified 
information is well documented. Hundreds of 
serious press leaks have significantly impaired U.S. 
capabilities against our hardest targets. In our 
classified report we detail several leaks that have 
collectively cost the American people hundreds of 
millions of dollars, and have done grave harm to 
national security.” 


~ Commission on the Intelligence 

Capabilities of the United States Regarding 
Weapons of Mass Destruction (WMD Commission 
Report), 2005 


Lesson 2.1: Identifying Damage 

In 2005, the results of the Weapons of Mass Destruction (WMD) Commission were presented to 
President Bush. The WMD Commission had been charged with investigating IC deficiencies, especially 
those related to intelligence regarding Iraq and their WMD program. The unclassified final WMD 
Commission Report identified several concerns, including the harm caused by unauthorized disclosures. 


Call Out Box: 
“The scope of damage done to our collection capabilities from media disclosures of classified 
information is well documented. Hundreds of serious press leaks have significantly impaired U.S. 
capabilities against our hardest targets. In our classified report we detail several leaks that have 
collectively cost the American people hundreds of millions of dollars, and have done grave harm to 
national security.” 

~Commission on the Intelligence Capabilities of the United States Regarding Weapons of Mass 

Destruction (WMD Commission Report), 2005 


(Image Alt: Collage of an emergency scene, the cover of the WMD Commission Report, and radiological 
symbols.) 
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Introduction 


There are six categories of damage to 
national security. 


Select the arrow in the top right corner to 


learn more about these categories before 
proceeding 


Lesson 2.1: Categories of Damage 

Introduction 

There are six categories of damage to national security. 

Select the arrow in the top right corner to learn more about these categories before proceeding. 


Damage to Sources and Methods 

When classified information is disclosed to unauthorized persons, the resultant damage extends beyond 
the specific information disclosed. These disclosures can give adversaries insight into the sources and 
methods used by the U.S. to collect information. Based on this knowledge, adversaries can take steps to 
either deny these collection efforts or take advantage of them and attempt to deceive the U.S. as to 
their true capabilities or intentions. 


Potential Loss of Life 

Intelligence collected from human sources (Human Intelligence or HUMINT) is particularly vulnerable to 
damage by unauthorized disclosure. Unfortunately, unauthorized disclosures of classified information by 
the media have been directly linked to the deaths of several individuals. 


Effect on International Alliances 
Unauthorized disclosures have had a negative impact on U.S. alliances with foreign partners by creating 
an atmosphere of distrust between the U.S. and foreign governments. 


In addition to international alliances with foreign governments, disclosures can also damage the 
relationship between the IC and allied intelligence services. This has the potential to lead to agencies 
being less willing to collaborate with the U.S. IC in the future. 


Financial Costs 

Damage to the IC and national security caused by unauthorized disclosures can be measured in terms of 
financial loss. According to the unclassified WMD Commission Report, disclosures have collectively cost 
the American public hundreds of millions of dollars. 


Impact to Foreign Policy 
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Unauthorized disclosures negatively impact foreign policy, including both the deliberation necessary to 
shape national policy as well as the implementation of approved policies. 


Distorting Public Perception 

In almost all cases of unauthorized disclosures, the public is only provided partial information. When this 
occurs, incorrect conclusions may be drawn based on the available information. Because the 
information is incomplete, the public actually may be less informed of the actions that the government 
is taking on their behalf. Since the government is unlikely to disclose additional classified information to 
clarify a previous unauthorized disclosure, the public is left with only partial information with which to 
form an opinion. 


(Image Alt: Six arrows labeled with each category showing a schematic, coffins, a foreign national, 
money, flags, and a statistical pie graph.) 
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Though there are many instances of damage caused by unauthorized disclosures, 
these are a few that demonstrate the magnitude of what can happen if obligations 
are not taken seriously. 


Select a link to read about the examples. 


Lesson 2.1: Examples of Damage from Unauthorized Disclosure 

Introduction 

Though there are many instances of damage caused by unauthorized disclosures, these are a few that 
demonstrate the magnitude of what can happen if obligations are not taken seriously. 

Select a link to read about the examples. 


Project Jennifer - Damage to Sources & Methods and Financial Costs 

Background: In the early 1970s, under a project with the code name "Project Jennifer," the U.S. was 
attempting to salvage a Soviet submarine that had sunk in the Pacific Ocean. Former Director of Central 
Intelligence (DCI) William Colby believed the successful recovery of the submarine would have been “the 
biggest single intelligence coup in history.” After the media discovered the existence of the operation, 
DCI Colby was able to convince several media outlets not to publish the information. Ultimately, the 
information was disclosed to the public when one media outlet refused Colby’s request. 


Result: Based on the Times article and other disclosures in the U.S. media, the Soviets were able to send 
surveillance vessels to the salvage site, reportedly leading to the premature discontinuation of the 
operation. This project is reported to have cost $550 million, including $200 million to build the ship, 
“Glomar Explorer,” which had been specifically designed to salvage the submarine. After the disclosure, 
the ship was unable to participate in future intelligence operations. 


(Image Alt: Collage on newspaper articles and Soviet hammer and sickle.) 


Beirut Barracks - Loss of Life and Damage to Sources & Methods 

Background: In April 1983, a television network and a newspaper reported that the U.S. was 
intercepting encrypted communications to Iran from a terrorist group in Syria. 

Result: These communications were discontinued shortly after the disclosure. This undermined efforts 
to capture the terrorist leaders and eliminated a source of information about future attacks. In October 
1983, 241 U.S. servicemen were killed when terrorists attacked the Marine Corps barracks in Beirut, 
Lebanon. The same terrorist group from whom the communications were intercepted is reported to 
have been responsible for the attack at the Marine Corps barracks. What cannot be known is if the 


Last updated: September 2011 21 


509 


510 


Unauthorized Disclosures of Classified Information Text Alternative 


attack could have been prevented if the intelligence from the intercepted communications had not been 
lost. 


(Image Alt: Cover of Time magazine with headline, “Carnage in Beirut.”) 


Gamma Guppy - Loss of Life and Damage to Sources & Methods 

Background: Under an effort with the code name "Gamma Guppy," the U.S. exploited its capability to 
intercept communications from the limousines of senior officials within the Soviet government. In 1971, 
the Washington Post disclosed this capability with a headline that read “CIA Eavesdrops on Kremlin 
Chiefs.” 


Result: After the article was published, the Soviets began encrypting the conversations so that 
additional information was inaccessible. In addition, the Central Intelligence Agency (CIA) reportedly lost 
contact with an asset who had worked as a mechanic on the limousines. He was never heard from again 
and presumed killed. 


(Image Alt: Collage of newspaper article and Soviet limousine.) 


Welch/Kinsman - Loss of Life 

Background: In 1969, Philip Agee, a former Case Officer, resigned from the CIA, moved out of the 
country, and began his campaign to weaken the CIA because of his ideological differences with the 
mission of the agency. As part of his campaign against the CIA, Agee was determined to expose CIA 
activity outside the U.S., including identifying CIA employees assigned overseas. An early 1975 edition of 
the magazine, Counterspy, published an article which included the following quote from Agee, “The 
most effective and important systematic attempts to combat the CIA that can be undertaken right now 
are, | think, the identification, exposure, and neutralization of its people working abroad.” In the same 
issue of Counterspy, Richard Welch was identified as the CIA’s Chief of Station (COS) in Greece. On 
November 25th, a Greek newspaper, the Athens Daily, also published Welch's identity. In 1980, the 
magazine, Covert Action Bulletin, also with a reported affiliation to Philip Agee, revealed the identities of 
15 CIA officials working in Jamaica. 


Result: On December 24, 1975, just one month after the article was published in the Athens Daily; COS 
Richard Welch was assassinated outside of his home in Athens. In 1980, just two days after the Covert 
Action Bulletin article was published, an attempt was made on the life of Richard Kinsman, who had 
been identified as the COS in Jamaica. Agee ultimately settled in Cuba, where he ran a travel agency 
until his death. He never returned to the U.S. after he began disclosing information about the identities 
of CIA employees and their activities 


(Image Alt: Newspaper article with images of Richard Welch.) 


Curveball - Impact to International Alliances 

Background: Prior to the U.S. invasion of Iraq, “Curveball” was recruited by an allied foreign intelligence 
service to provide information regarding the status of Iraq's WMD program. As later explained in the 
WMD Commission Report, the allied intelligence service refused a request from the U.S. IC for direct 
access to Curveball for fear that his identity would be leaked. As it turned out, the information provided 
by Curveball was later determined not to be credible. 
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Result: Because the U.S. did not have direct access to Curveball, the IC was unable to directly assess his 
credibility and the accuracy of his information. This contributed to the analytical inaccuracies related to 
the status of lraq’s WMD program. Ultimately, Curveball’s identity was disclosed by the U.S. media. This 
action potentially strained the political relationship between the U.S. and its ally, possibly threatening 
future collaboration. 


(Image Alt: Collage of 60 Minutes expose and images of Curveball.) 
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The potential damage to national security from 
unauthorized disclosures has been recognized by not 
only the IC, but also by several well-known 
journalists and media organizations. 


A 


T 


D, A o 
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View all journalist quotes before proceeding. 
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Lesson 2.1: Damage from Disclosures — Media Recognition 
The potential damage to national security from unauthorized disclosures has been recognized by not 
only the IC, but also by several well-known journalists and media organizations. 


(Image Alt: Collage of Walter Cronkite, Jack Nelson, and sound waves.) 


Quote: 
"Some leaks can endanger national security. We recognize that the government has a legitimate interest 
in protecting our national security secrets...Investigating and prosecuting those who leak information 
that causes harm is understandable." 

~Tom Brokaw, Walter Cronkite, and Ted Koppel (May 2006) 


(Image Alt: Collage of Ted Koppel, Walter Cronkite, and Tom Brokaw.) 


Quote: 
"Newspapers recognize that the government has a duty to preserve national security and that some 
leaks may cause damage." 

~Newspaper Association of America and National Newspaper Association (May 2006) 


(Image Alt: Collage of newspapers, the Newspaper Association of America logo, and the National 
Newspaper Association logo.) 


Quote: 
"You may recall that in April 1983, some 60 people were killed in a bomb attack on the U.S. embassy in 
Beirut. At the time, there was coded radio traffic between Syria, where the operation was being run, and 
Iran, which was supporting it. Alas, one television network and a newspaper columnist reported that the 
U.S. government had intercepted the traffic. Shortly thereafter the traffic ceased. This undermined 
efforts to capture the terrorist leaders and eliminated a source of information about future attacks. Five 
months later, apparently the same terrorists struck again at the Marine barracks in Beirut; 241 
servicemen were killed." 

~Katherine Graham, Chief Executive Officer (CEO), Washington Post (April 1986) 
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(Image Alt: Collage of a Newsweek magazine featuring Katherine Graham, the Washington Post building, 
a Washington Post headline, and a young Katherine Graham.) 
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Lesson 2.1: Damage from Disclosures - Recognition beyond the 
IC and U.S. Media 


The U.S. IC and media are not the only entities that recognize the potential damage resulting from 
unauthorized disclosures. Members of the Judicial and Legislative Branches have also recognized the 
damage caused to national security. Even more disturbing, foreign adversaries have identified the 
benefits gained by disclosures in the U.S. media 


Judicial Branch 
“. the danger to the United States is just as 


X e i Legislative Branch 
great when this information is released to the “The fact of the matter Is, some of the worst 


damage done to our IC has come not from 
penetration by spies, but from unsuthorized 
w U.S. vs. Morison (1985) leaks by those with access to classified 


press as when It is released to an agent of a 
foreign government,” 


information.” 


~ Representative Peter Hoekstra, 
Ranking Member, House Permanent Select 
Committee on Intelligence (HPSCT) 


Foreign Adversary 
“I was amazed - and Moscow was very appreciative - at how many times I found very 
sensitive information in American newspapers. In my view, Americans tend to care more 
about scooping their competition than about national security, which made my job easier.” 


æ Stanislav Lunev, former Russian military intelligence officer and author of 
Through the Eyes of the Enemy (1999) 


Lesson 2.1: Damage from Disclosures — Recognition beyond the IC and U.S. Media 

The U.S. IC and media are not the only entities that recognize the potential damage resulting from 
unauthorized disclosures. Members of the Judicial and Legislative Branches have also recognized the 
damage caused to national security. Even more disturbing, foreign adversaries have identified the 
benefits gained by disclosures in the U.S. media. 


Call Out Box: 
Judicial Branch 
“... the danger to the United States is just as great when this information is released to the press as 
when it is released to an agent of a foreign government.” 
~U.S. vs. Morison (1985) 


Call Out Box: 
Legislative Branch 
“The fact of the matter is, some of the worst damage done to our IC has come not from penetration by 
spies, but from unauthorized leaks by those with access to classified information.” 
~Representative Peter Hoekstra, Ranking Member, House Permanent Select Committee on 
Intelligence (HPSCI) 


Call Out Box: 
Foreign Adversary 
“| was amazed — and Moscow was very appreciative — at how many times | found very sensitive 
information in American newspapers. In my view, Americans tend to care more about scooping their 
competition than about national security, which made my job easier.” 
~Stanislav Lunev, former Russian military intelligence officer and author of Through the Eyes of 
the Enemy (1999) 
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Lesson 2.1: Knowledge Check 


Identify each category of damage from the description provided. 


Select the correct responses from the drop-down list and select SUBMIT. 


Unauthorized disclosure that 
provides insight to adversaries on 
how the information was obtained 
and by whom. 


Unauthorized disclosure that can 
cause casualties, 


Unauthorized disclosure that 
impacts a foreign government's or 
intelligence service's willingness to 
work jointly with the U.S, 


Unauthorized disclosure that 
requires significant amounts of 
money to correct, 


1. Identify each category of damage from the description provided. 
Select the correct responses from the drop-down list and select SUBMIT. 


Descriptions: 
a) Unauthorized disclosure that provides insight to adversaries on how the information was 
obtained and by whom. 
b) Unauthorized disclosure that can cause casualties. 
c) Unauthorized disclosure that impacts a foreign government's or intelligence service's willingness 
to work jointly with the U.S. 
d) Unauthorized disclosure that requires significant amounts of money to correct. 


Category of Damage: 
Damage to Sources and Methods 
Effect on International Alliances 
Financial Costs 
Potential Loss of Life 
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Correct Responses: 


a) 


b) 
c) 


d) 


Unauthorized disclosure that provides insight to adversaries on how the information was 
obtained and by whom. - Damage to Sources and Methods 

Unauthorized disclosure that can cause casualties. - Potential Loss of Life 

Unauthorized disclosure that impacts a foreign government’s or intelligence service's willingness 
to work jointly with the U.S. - Effect on International Alliances 

Unauthorized disclosure that requires significant amounts of money to correct. - Financial Costs 


Feedback when correct: 
That’s right! You selected the correct responses. 


The other two categories of damage are the Impact to Foreign Policy and the Distortion of Public 
Perception. 


Feedback when incorrect: 
Sorry, you did not select the correct responses. 


There are six categories of damage - their descriptions are shown here. Though not all may be applicable 
in every instance, each is an impact associated with unauthorized disclosures. 


Damage to Sources and Methods is an unauthorized disclosure that provides insight to 
adversaries on how the information was obtained and by whom. 

Potential Loss of Life is an unauthorized disclosure that can cause casualties. 

Effect on International Alliances is an unauthorized disclosure that impacts a foreign 
government’s or intelligence service's willingness to work jointly with the U.S. 

Financial Costs is an unauthorized disclosure that requires significant amounts of money to 
correct. 

Impact to Foreign Policy is an unauthorized disclosure that may damage political relationships, 
negatively effecting the creation and implementation of foreign policy. 

Distorting Public Perception is an unauthorized disclosure that influences public opinion. 
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Lesson 2: Summary 


Throughout history, unauthorized disclosures have caused 
significant damage to our national security. Media leaks can 
be associated with six categories of damage, which can 
also be applied to other unauthorized disclosures, 

Including: 


Potential Loss of Life 
* Damage to Sources and Methods 
* Effect on International Alliances 
* Financial Costs 
* Impact to Foreign Policy 
* Misinforrning or Distorting Public Perception 


It is essential that you are aware of the impact that 
unauthorized disclosures can have on the ability of the IC 
to provide timely and actionable intelligence in support of 
national security objectives. 


Lesson 2: Summary 

Throughout history, unauthorized disclosures have caused significant damage to our national security. 
Media leaks can be associated with six categories of damage, which can also be applied to other 
unauthorized disclosures, including: 


Potential Loss of Life 

Damage to Sources and Methods 

Effect on International Alliances 

Financial Costs 

Impact to Foreign Policy 

Misinforming or Distorting Public Perception 


It is essential that you are aware of the impact that unauthorized disclosures can have on the ability of 
the IC to provide timely and actionable intelligence in support of national security objectives. 


(Image Alt: Collage of a newspaper headline, money, the Soviet hammer and sickle, and a Soviet 
limousine.) 
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Text Alternative 


Lesson 3: Misconceptions and Employee Responsibilities 


Topic 3.1: Misconceptions Related to Unauthorized Disclosures 
(Approximately 5 minutes) 
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Lesson 3.1: Introduction and Objective 


No matter what the motivation or justification, you should 
never believe it is appropriate to disclose classified 
information to an unauthorized person. There are many 
misconceptions related to the unauthorized disclosure of 
classified information. In this topic, you will explore these 
misconceptions. 


Objective 
* Identify key misconceptions related to unauthorized 
disclosures 


Lesson 3.1: Introduction and Objective 

No matter what the motivation or justification, you should never believe it is appropriate to disclose 
classified information to an unauthorized person. There are many misconceptions related to the 
unauthorized disclosure of classified information. In this topic, you will explore these misconceptions. 


Objective 
e Identify key misconceptions related to unauthorized disclosures 


(Image Alt: Collage of a person blowing a whistle, a dollar symbol, and a road sign with arrows pointing 
to “High Road” and “Low Road.”) 
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There are several misconceptions IC employees may have in relation to the 
unauthorized disclosure of classified information. 


Select a misconception for more information 


Lesson 3.1: Misconceptions 

Introduction 

There are several misconceptions IC employees may have in relation to the unauthorized disclosure of 
classified information. 


Select a misconception for more information. 


My identity is protected by Journalists' Privilege 
Misconception: Journalists’ Privilege allows a reporter to withhold the identity of a government source 
during grand jury proceedings. 


Truth: Though a journalist may tell a potential government source that the source’s identity is safe as a 
way to motivate the source to disclose information, there is no federal privilege that allows a journalist 
to protect the identity of a source during grand jury proceedings. 


Quote: 
“Reporters, like other citizens, [must] respond to relevant questions put to them in the course of a valid 
grand jury investigation or criminal trial.” 

~Branzburg vs. Hayes (1972) 


According to the Justice Department, journalists have been subpoenaed on 19 occasions between 1991 
and 2007. In once recent incident, journalist Judith Miller was imprisoned for 85 days for contempt of 
court prior to ultimately identifying her government source. 


(Image Alt: Judith Miller behind bars.) 


| am protected by the Whistleblower Protection Act (WPA) 
Misconception: Unauthorized disclosures are protected by the WPA of 1989 and the IC WPA of 1998. 


Truth: The WPA and IC WPA do authorize the disclosure of classified information, but it must be in the 
proper venue and only to authorized individuals such as an agency Inspector General, specific members 
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of Congress, or other authorized government officials as delineated in these statutes. The media is 
NOT an authorized recipient of classified information under either of these laws. 


The intent of the WPA is to protect "whistleblowers" from any adverse actions an agency makes in 
retaliation for whistleblowing activity such as reporting a violation of a law, rule, or regulation; gross 
mismanagement; gross waste of funds; an abuse of authority; or a substantial and specific danger to 
public health or safety. It does not protect “whistleblowers” from adverse actions taken for any other 
conduct, and it does not protect leakers who make unauthorized disclosures. 


(Image Alt: Collage of a whistle and the cover of the Federal Whistleblower Laws and Regulations.) 


lam protected under the First Amendment 
Misconception: Unauthorized disclosures are always protected as free speech under the First 
Amendment of the Constitution. 


Truth: Considering published court opinions, the First Amendment is not guaranteed as a valid defense 
for a government employee who discloses classified information. 


Quote: 
“It would be frivolous to assert ... that the First Amendment ... confers a license on either the reporter or 
his news sources to violate valid criminal laws. [NJeither reporter nor source is immune from conviction 
for such conduct ...” 

~ Supreme Court Justice Byron White, Branzburg v. Hayes 408 U.S. 665 (1972) 


Quote: 
“{T]he First Amendment imposes no blanket prohibition on prosecution for unauthorized leaks of 
classified information.” 

~Judge Harvie Wilkinson, 4th Circuit U.S. v Samuel Morison (1985) 


(Image Alt: Collage of a governing document, Judge Harvie Wilkinson, and Supreme Court Justice Byron 
White.) 
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Lesson 3.1: Knowledge Check 


Which of the following are misconceptions relating to the receipt of unauthorized disclosures 
by the media? 


Select all that apply and select SUBMIT. 


“Journalists' Privilege" allows a reporter to withhold the identity of a government 
source during federal grand jury proceedings. 


The iC WPA creates provisions for reporting classified information to authorized 
government officials. 


Unauthorized disclosures are protected as free speech under the First 
Amendment of the Constitution, 


1. Which of the following are misconceptions relating to the receipt of unauthorized disclosures by 
the media? 


Select all that apply and select SUBMIT. 
a) "Journalists' Privilege" allows a reporter to withhold the identity of a government source during 


federal grand jury proceedings. 

b) The IC WPA creates provisions for reporting classified information to authorized government 
officials. 

c) Unauthorized disclosures are protected as free speech under the First Amendment of the 
Constitution. 
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Correct Responses: 
a) "Journalists' Privilege" allows a reporter to withhold the identity of a government source during 
federal grand jury proceedings. 
c) Unauthorized disclosures are protected as free speech under the First Amendment of the 
Constitution. 


Feedback when correct: 
That's right! You selected the correct responses. 


The IC WPA does create provisions for reporting classified information to authorized agency officials, 
such as an agency Inspector General, the Department of Justice (DoJ), or specific members of Congress. 


Feedback when incorrect: 
You did not select the correct responses. The first and third responses are misconceptions. 


Response 1: Journalists’ Privilege allows a reporter to withhold the identity of a government source 
during grand jury proceedings. 


This is a misconception. Though a journalist may tell a potential government source that the source’s 
identity is safe as motivation for the source to disclose information, there is no federal privilege that 
allows a journalist to protect the identity of a source during grand jury proceedings. 


Response 2: The /C WPA creates provisions for reporting classified information to authorized 
government officials. 


This is True. Authorized government officials include an agency Inspector General, or specific members 
of Congress. 


Response 3: Unauthorized disclosures are protected as free speech under the First Amendment of the 
Constitution. 


This is a misconception. Based on several court rulings, the First Amendment is not considered a valid 
defense for a cleared employee who discloses classified information. 
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Which of the following statements are true regarding the Whisteblower Protection Act (WPA) 
and the ic WPA? 


Select all that apply and select SUBMIT. 


O Unauthorized disclosures are always protected by the WPA. 


o Employees are protected by the WPA if they are retaliated against for 
"whistleblower" activity. 


A "Whistleblower" activity involving classified information must only be disclosed to 
individuals specifically identified in the ZC WPA. 


2. Which of the following statements are true regarding the Whistleblower Protection Act (WPA) and 
the IC WPA? 


Select all that apply and select SUBMIT. 
a) Unauthorized disclosures are always protected by the WPA. 
b) Employees are protected by the WPA if they are retaliated against for "whistleblower" activity. 
c) "Whistleblower" activity involving classified information must only be disclosed to individuals 
specifically identified in the IC WPA. 
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Correct Responses: 
b) Employees are protected by the WPA if they are retaliated against for "whistleblower" activity. 
c) "Whistleblower" activity involving classified information must only be disclosed to individuals 
specifically identified in the IC WPA. 


Feedback when correct: 
That’s right! You selected the correct responses. 


Feedback when incorrect: 
You did not select the correct responses. The second and third responses are correct. 


Response 1: Unauthorized disclosures are always protected by the WPA. 


This is not true. Unauthorized disclosures are never protected by the WPA. Disclosures to authorized 
individuals under the IC WPA are not unauthorized disclosures. The IC WPA does identify proper venues 
for the disclosure of classified information to authorized individuals such as authorized agency officials, 
an agency Inspector General, or specific members of Congress; the media is not recognized as an 
authorized recipient of classified information. Therefore, unauthorized disclosure to the media is not 
protected by the WPA. 


Response 2: Employees are protected by the WPA if they are retaliated against for "whistleblower" 
activity. 


This is true. The intent of the WPA is to protect "whistleblowers" from any adverse actions an agency 
makes in retaliation for “whistleblower” activity such as reporting a violation of a law, rule, or 
regulation; gross mismanagement; gross waste of funds; an abuse of authority; or a substantial and 
specific danger to public health or safety. It does not protect “whistleblowers” from adverse actions 
taken for any other conduct, nor does it protect individuals who make unauthorized disclosures. 


Response 3: "Whistleblower" activity involving classified information must only be disclosed to 
individuals specifically identified in the IC WPA. 


This is true. Authorized agency officials include an agency Inspector General, or specific members of 
Congress. 
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Lesson 3: Misconceptions and Employee Responsibilities 


Topic 3.2: Employee Responsibilities and Accountability 
(Approximately 10 minutes) 
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Lesson 3.2: Introduction and Objectives 


The privilege of being granted a security clearance comes 
with great responsibilities. You accepted these 
responsibilities when you signed your NdA. Your key 
responsibilities include appropriately classifying and handling 
Information, preventing unauthorized disclosures, and 
immediately reporting unauthorized disclosures. Serious 
consequences, including both administrative and criminal 
sanctions, can occur if you fail to fulfill your commitment 
Federal statutes, such as the Espionage Act and the Hiss 
Act, identify some of these potential penalties. In the end, if 
you disclose classified information, you risk damaging the 
nation and yourself. This lesson examines your 
responsibilities and the consequences that you face if these 
responsibilities are not upheld. 


Objectives 
* Explain the purpose of the NdA 
* Identify administrative and criminal sanctions for 
unauthorized disclosures 
+ Describe the damage caused by unauthorized 
disclosures 


Lesson 3.2: Introduction and Objectives 

The privilege of being granted a security clearance comes with great responsibilities. You accepted these 
responsibilities when you signed your NdA. Your key responsibilities include appropriately classifying 
and handling information, preventing unauthorized disclosures, and immediately reporting 
unauthorized disclosures. Serious consequences, including both administrative and criminal sanctions, 
can occur if you fail to fulfill your commitment. Federal statutes, such as the Espionage Act and the Hiss 
Act, identify some of these potential penalties. In the end, if you disclose classified information, you risk 
damaging the nation and yourself. This lesson examines your responsibilities and the consequences that 
you face if these responsibilities are not upheld. 


Objectives 
e Explain the purpose of the NdA 
e Identify administrative and criminal sanctions for unauthorized disclosures 
e Describe the damage caused by unauthorized disclosures 


(Image Alt: Uncle Sam pointing at learner.) 
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Lesson 3.2: Responsibility - Completing an NdA 


The NdA is a contract between you and the U.S. Government that creates a lifetime obligation to 
protect classified information. The importance of this contract, and your resulting responsibilities to 
national security, cannot be overstated. 


The NdA specifically states that the failure to properly protect classified information may result in 
several criminal or administrative sanctions as outlined by various governing documents 


“In addition, I have been advised that any unauthorized disclosure of classified 
Information by me may constitute a violation, or violations of...” 
18 United States Code (USC) 793 / 794 / 798 of the Espionage Act 
* 18USC 641 (Theft of Government Property) 
50 USC 421 of the Intelligence Identities Protection Act 


Individuals who have been granted access to classified information must understand their 
obligations to safeguard this information. You must also be aware of additional responsibilities, 
Including 

* Properly classifying and handling information 

* Reporting unauthorized disclosures 

+ Obtaining proper authorization prior to communicating with the media 

* Submitting all material related to your position for pre-publication review prior to public 

release 


Lesson 3.2: Responsibility - Completing an NdA 

The NdA is a contract between you and the U.S. Government that creates a lifetime contractual 
obligation to protect classified information. The importance of this contract, and your resulting 
responsibilities to national security, cannot be overstated. 


The NdA specifically indicates that the failure to properly protect classified information may result in 
several criminal or administrative sanctions as outlined by various governing documents. 


Call Out Box: 

“| have been advised that the unauthorized disclosure, ...of classified information by me could cause 
damage...to the United States. | further understand that | am obligated to comply with laws and 
regulations...” 


Call Out Box: 
“In addition, | have been advised that any unauthorized disclosure of classified information by me may 
constitute a violation, or violations of...” 

e 18 United States Code (USC) 793 / 794 / 798 of the Espionage Act 

+ 18 USC 641 (Theft of Government Property) 

e 50 USC 421 of the Intelligence Identities Protection Act 


Individuals who have been granted access to classified information must understand their obligations to 
safeguard classified information. You must also be aware of additional responsibilities, including: 

e Properly classifying and handling information 

e Reporting unauthorized disclosures 

e Obtaining proper authorization prior to communicating with the media 

e Submitting all material related to your position for pre-publication review prior to public release 
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Lesson 3.2: Impact to Nation and Individual 


The bottom line is that when a cleared employee improperly discloses classified information, they risk 
darnaging the nation and themselves. 


Damage to Nation Harm to Individual 


Damages national security Revocation of security clearance 

Damages IC capabilities Termination of employment 

Impacts IC's ability to perform its mission + Criminal prosecution and associated 

Benefits adversaries wishing to harm the penalties 

U.S. Loss of pension and other retirement 
benefits 


Lesson 3.2: Administrative and Criminal Sanctions 
The type of sanction which can be levied depends on the nature and severity of the disclosure. 


Administrative 
Administrative sanctions include: 
e Suspension without pay 
e Revocation of clearance 
e Termination of employment 


Federal statute specifically allows the heads of agencies to terminate an employee if they believe the 
termination is necessary in the interest of national security. 


Criminal 
Criminal sanctions include: 
e Incarceration 
e Fines 
e Death penalty (under very specific circumstances) 


Several of the criminal statutes identified on the NdA are part of the 1917 Espionage Act. 


(Image Alt: Collage of man looking through prison bars, a contract being ripped in half, and an employee 
packing up his desk.) 
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Various sanctions can be imposed on individuals depending on the information that 
was disclosed and to whom it was provided. Two of the more well-known 
authoritative documents are the Espionage Act of 1917 and the Federal Pension 
Forfeiture Act, which is more commonly known as the Hiss Act of 1954, The 
criminal statutes identified in the NdA are codified under the Espionage Act (Title 18 
USC 793-798), while the Hiss Act outlines the potential loss of retirement benefits. 


Select a title below to learn about the penalties you would face should you disclose 
classified information 


Lesson 3.2: Sanctions for Unauthorized Disclosure 

Introduction 

Various sanctions can be imposed on individuals depending on the information that was disclosed and 
to whom it was provided. Two of the more well-known authoritative documents are the Espionage Act 
of 1917 and the Federal Pension Forfeiture Act, which is more commonly known as the Hiss Act of 1954. 
The criminal statutes identified in the NdA, are codified under the Espionage Act (Title 18 USC 793-798), 
while the Hiss Act outlines the potential loss of retirement benefits. 


Select a title below to learn about the penalties you would face should you disclose classified 
information. 


Unauthorized retention or disclosure of national defense information 

Section 793 of the Espionage Act discusses the unauthorized retention or disclosure of national defense 
information to any person not entitled to receive it. If you improperly disclose or retain national defense 
information you can be fined, incarcerated for up to ten years, or both. 


Unauthorized disclosure to a foreign government 

The Espionage Act of 1917 is best recognized for Section 794 which prohibits the disclosure of classified 
information to a foreign government. If you disclose classified information to a foreign government, you 
can be punished by death or incarcerated for any term of years up to life. 


Unauthorized disclosure of COMINT 

Section 798 of the Espionage Act specifically prohibits the disclosure or publication of communications 
intelligence (COMINT) to any unauthorized person. If you improperly disclose COMINT, you can be fined, 
incarcerated for up to ten years, or both. 


Additional Sanctions 

In accordance with the Hiss Act which was passed in 1954 and amended in 1961, an individual convicted 
of certain offenses, including the provisions of the Espionage Act, may not be paid a federal annuity or 
pension. 
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Lesson 3.2: Knowledge Check 1 


Motivated by a desire to obtain a full-time position with Jane's Defense Weekly, Samuel 
Loring Morison, a former Department of the Navy analyst, disclosed satellite Imagery 
Intelligence (IMINT) to the magazine. Morison was convicted in Federal District Court in 
October 1985, Morison was sentenced to 24 months confinement; his conviction was upheld 
by the 4th Circuit Court of Appeals and the Supreme Court. 


Which section(s) of the Espionage Act applied to the conviction of Morison? 


Select all that apply and select SUBMIT. 


The Espionage Act, USC 793 (retention or disclosure of national defense 
information) 


The Espionage Act, USC 794 (disclosure to a foreign government) 


The Espionage Act, USC 798 (disclosure of COMINT) 


1. Motivated by a desire to obtain a full-time position with Jane's Defense Weekly, Samuel Loring 
Morison, a former Department of the Navy analyst, disclosed satellite Imagery Intelligence 
(IMINT) to the magazine. Morison was convicted in Federal District Court in October 1985. 
Morison was sentenced to 24 months confinement; his conviction was upheld by the 4th Circuit 
Court of Appeals and the Supreme Court. 


Which section(s) of the Espionage Act applied to the conviction of Morison? 


Select all that apply and select SUBMIT. 
a) The Espionage Act, USC 793 (retention or disclosure of national defense information) 
b) The Espionage Act, USC 794 (disclosure to a foreign government) 
c) The Espionage Act, USC 798 (disclosure of COMINT) 
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Correct Response: 
a) The Espionage Act, USC 793 (retention or disclosure of national defense information) 


Feedback when correct: 
That's right! You selected the correct response. 


Feedback when incorrect: 
You did not select the correct response. 


The correct response is The Espionage Act, USC 793. USC 794 is not correct because there was no foreign 
entity involved. USC 798 is not correct because the disclosed information was IMINT rather than 
COMINT. 
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Motivated by his desire to impact U.S. policy, Larry Franklin, a former DoD employee, was 
charged with conspiracy to communicate national defense information to U.S. employees of 
the American Israel Public Affairs Committee (AIPAC), communication of national defense 
communications information (COMINT) to persons not entitled to receive it, and unlawful 
retention of national defense information. Franklin pled guilty in 2006 and was sentenced to 
12.5 years of confinement. The information disclosed by Franklin related to U.S, Middle East 
policy. 


Which section(s) of the Espionage Act applied to the conviction of Franklin? 


Select all that apply and select SUBMIT. 


o The Espionage Act, USC 793 (retention or disclosure of national defense 
information) 


O The Espionage Act, USC 794 (disclosure to a foreign government) 


OO The Espionage Act, USC 798 (disclosure of COMINT) 


2. Motivated by his desire to impact U.S. policy, Larry Franklin, a former DoD employee, was charged 
with conspiracy to communicate national defense information to U.S. employees of the American 
Israel Public Affairs Committee (AIPAC), communication of national defense communications 
information (COMINT) to persons not entitled to receive it, and unlawful retention of national 
defense information. Franklin pled guilty in 2006 and was sentenced to 12.5 years of confinement. 
The information disclosed by Franklin related to U.S. Middle East policy. 


Which section(s) of the Espionage Act applied to the conviction of Franklin? 


Select all that apply and select SUBMIT. 
a) The Espionage Act, USC 793 (retention or disclosure of national defense information) 
b) The Espionage Act, USC 794 (disclosure to a foreign government) 
c) The Espionage Act, USC 798 (disclosure of COMINT) 
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Correct Responses: 
a) The Espionage Act, USC 793 (retention or disclosure of national defense information) 
c) The Espionage Act, USC 798 (disclosure of COMINT) 


Feedback when correct: 
That's right! You selected the correct responses. 


Feedback when incorrect: 
You did not select the correct responses. 


The correct responses are The Espionage Act, USC 793 (retention or disclosure of national defense 
information) and The Espionage Act, USC 798 (disclosure of COMINT). USC 794 is not correct because 
there was not a foreign entity involved. 
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Motivated by his desire to impact U.S. policy, former Lieutenant Commander Matthew Diaz 
of the U.S. Navy disclosed national defense information to a legal advocacy group, the 
Center for Constitutional Rights. He was convicted at General Court-Martial in May of 2007 
and sentenced to six months confinement and dismissal from the U.S. Navy for Failure to 
Obey a Lawful General Order and Conduct Unbecoming an Officer. Diaz also lost his pension 
benefit after serving in the military for over 18 years. The information disclosed by Diaz 
related to the identities of detainees being held at the Guantanamo detention facility. 


Which section(s) of the Espionage Act applied to the conviction of Diaz? 


Select all that apply and select SUBMIT, 


o The Espionage Act, USC 793 (retention or disclosure of national defense 
information) 


O The Espionage Act, USC 794 (disclosure to a foreign government) 


O The Espionage Act, USC 798 (disclosure of COMINT) 


3. Motivated by his desire to impact U.S. policy, former Lieutenant Commander Matthew Diaz of the 
U.S. Navy disclosed national defense information to a legal advocacy group, the Center for 
Constitutional Rights. He was convicted at General Court-Martial in May of 2007 and sentenced to 
six months confinement and dismissal from the U.S. Navy for Failure to Obey a Lawful General 
Order and Conduct Unbecoming an Officer. Diaz also lost his pension benefit after serving in the 
military for over 18 years. The information disclosed by Diaz related to the identities of detainees 
being held at the Guantanamo detention facility. 


Which section(s) of the Espionage Act applied to the conviction of Diaz? 


Select all that apply and select SUBMIT. 
a) The Espionage Act, USC 793 (retention or disclosure of national defense information) 
b) The Espionage Act, USC 794 (disclosure to a foreign government) 
c) The Espionage Act, USC 798 (disclosure of COMINT) 
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Correct Response: 
a) The Espionage Act, USC 793 (retention or disclosure of national defense information) 


Feedback when correct: 
That's right! You selected the correct response. 


Feedback when incorrect: 
You did not select the correct response. 


The correct response is The Espionage Act, USC 793 (retention or disclosure of national defense 
information). USC 794 is not correct because there was no foreign entity involved and USC 798 is not 
correct because the information was not COMINT. 
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Samuel Leibowitz, a former Federal Bureau of Investigation (FBI) linguist, disclosed 
communications intelligence (COMINT) to an Internet blogger; his motivation was unclear. In 
December of 2009, Leibowitz was convicted and sentenced to 20 months incarceration, 
Which section(s) of the Espionage Act applied to the conviction of Leibowitz? 

Select all that apply and select SUBMIT. 


o The Espionage Act, USC 793 (retention or disclosure of national defense 
information) 


CO The Espionage Act, USC 794 (disclosure to a foreign government) 


OD The Espionage Act, USC 798 {disclosure of COMINT) 


4. Samuel Leibowitz, a former Federal Bureau of Investigation (FBI) linguist, disclosed 
communications intelligence (COMINT) to an Internet blogger; his motivation was unclear. In 
December of 2009, Leibowitz was convicted and sentenced to 20 months incarceration. 


Which section(s) of the Espionage Act applied to the conviction of Leibowitz? 


Select all that apply and select SUBMIT. 
a) The Espionage Act, USC 793 (retention or disclosure of national defense information) 
b) The Espionage Act, USC 794 (disclosure to a foreign government) 
c) The Espionage Act, USC 798 (disclosure of COMINT) 
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Correct Response: 
c) The Espionage Act, USC 798 (disclosure of COMINT) 


Feedback when correct: 
That's right! You selected the correct response. 


Feedback when incorrect: 
You did not select the correct response. 


The correct response is The Espionage Act, USC 798 (disclosure of COMINT). USC 793 is not the best 
response because the intelligence disclosed was COMINT, which is specifically covered in USC 798. USC 
794 is not correct because there was not a foreign entity involved. 
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Lesson 3.2: Responsibility - Reporting Unauthorized Disclosures 


If you identify a suspected unauthorized disclosure, it is your obligation to notify the responsible agency 
element immediately. Individual agency guidelines will identify appropriate channels for reporting. You 
should be knowledgeable of these reporting requirements. Your agency's Special Security Officer (SSO) 
will be able to provide additional information. 


It is essential that you remain alert for potential unauthorized disclosures. With the proliferation of 
online blogs, journals, and other media outlets, you may be the first or only cleared employee who 
identifies a potentially harmful 

disclosure. Every employee, 

whether they have access to 

classified information or not, has 

a responsibility to report the 

actions of another employee if 

they believe that behavior has 

led, or will lead, to an 

unauthorized disclosure. 


Lesson 3.2: Responsibility — Reporting Unauthorized Disclosures 

If you identify a suspected unauthorized disclosure, it is your obligation to notify the responsible agency 
element immediately. Individual agency guidelines will identify appropriate channels for reporting. You 
should be knowledgeable of these reporting requirements. Your agency’s Special Security Officer (SSO) 
will be able to provide additional information. 


It is essential that you remain alert for potential unauthorized disclosures. With the proliferation of 
online blogs, journals, and other media outlets, you may be the first or only cleared employee who 
identifies a potentially harmful disclosure. Every employee, whether they have access to classified 
information or not, has a responsibility to report the actions of another employee if they believe that 
behavior has led, or will lead, to an unauthorized disclosure. 


(Image Alt: A shocked man looking at a social networking site.) 
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Lesson 3.2: Pre-Publication Review and Contact with Members of 
the Media 


Agency guidelines may also cover specific prohibitions, such as unapproved contact with members of the 
media. For example, the ODNI Instruction 85.01, “Interaction with the Media,” states: 


All material related to your position in the IC must be submitted for 
pre-publication review prior to public release. 


As a cleared professional, you are required to submit for pre- 
publication review any information that you create for non-official 
purposes, If it is based on knowledge gained by your access to 
classified data. 


This review ensures that the information you create does not 
compromise any classified information or activity. The following are 
some examples of information that may require a review 

* Speeches, articles, white papers, etc 

+ Web pages, blogs, video teleconferences, etc 


Cowrat 
You should familiarize yourself with any similar regulations and ys 
requirements of your organization 


Lesson 3.2: Pre-Publication Review and Contact with Members of the Media 

Agency guidelines may also cover specific prohibitions, such as unapproved contact with members of 
the media. For example, the Office of the Director of National Intelligence (ODNI) Instruction 85.01, 
“Interaction with the Media,” states: 


Quote: 

“ODNI personnel may not have official or unofficial conversations with the media that relate in any way 
to the business of the ODNI or the Intelligence Community without prior Office of Public Affairs (OPA) 
approval.” 


Quote: 
“Under no circumstances will classified information or information that reveals intelligence sources and 
methods be released to the media or public.” 


All material related to your position in the IC must be submitted for pre-publication review prior to 
public release. 


As a cleared professional, you are required to submit for pre-publication review any information that 
you create for non-official purposes, if it is based on knowledge gained by your access to classified data. 
This review ensures that the information you create does not compromise any classified information or 
activity. The following are some examples of information that may require a review: 

e Speeches, articles, white papers, etc. 

e Web pages, blogs, video teleconferences, etc. 


You should familiarize yourself with any similar regulations and requirements of your organization. 


(Image Alt: Collage of a handshake, governing documents, the Capitol, and eyeglasses and a pen ona 
contract.) 


Last updated: September 2011 52 


540 


541 


Unauthorized Disclosures of Classified Information 


Text Alternative 


Lesson 3.2: Impact to Nation and Individual 


The bottom line is that when a cleared employee improperly discloses classified information, they risk 


damaging the nation and themselves. 


Damage to Nation 


Damages national security 

Damages IC capabilities 

Impacts IC's ability to perform its mission 
Benefits adversaries wishing to harm the 
U.S. 


Harm to Individual 


Revocation of security clearance 
Termination of employment 
Criminal prosecution and associated 


penalties 
Loss of pension and other retirement 
benefits 


Lesson 3.2: Impact to Nation and Individual 


The bottom line is that when a cleared employee improperly discloses classified information, they risk 


damaging the nation and themselves. 


Damage to Nation 
e Damage to national security 
e Damage to IC capabilities 
e Impact ICs ability to perform its mission 
e Benefit adversaries wishing to harm the U.S. 


Harm to Individual 
e Revocation of security clearance 
e Termination of employment 
e Criminal prosecution and associated penalties 
e Loss of pension and other retirement benefits 
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Lesson 3.2: Knowledge Check 2 


Which of the following are administrative sanctions that can be imposed for unauthorized 
disclosures? 


Select all that apply and select SUBMIT. 


O Suspension without pay 


O Revocation of clearance 
O Termination of employment 


O Incarceration 


1. Which of the following are administrative sanctions that can be imposed for unauthorized 
disclosures? 


Select all that apply and select SUBMIT. 
a) Suspension without pay 
b) Revocation of clearance 
c) Termination of employment 
d) Incarceration 
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Correct Responses: 
a) Suspension without pay 
b) Revocation of clearance 
c) Termination of employment 


Feedback when correct: 
That's right! You selected the correct responses. 


Feedback when incorrect: 
You did not select the correct responses. 


The correct responses are: 
e Suspension without pay 
e Revocation of clearance 
e Termination of employment 


Incarceration is a criminal sanction, which could apply for making an unauthorized disclosure. 
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Which of the following are at risk when an unauthorized disclosure occurs? 


Select all that apply and select SUBMIT. 


IC's ability to perform its mission 
Employee termination and loss of pension 
National security 


All of the above 


2. Which of the following are at risk when an unauthorized disclosure occurs? 


a) IC’s ability to perform its mission 

b) Employee termination and loss of pension 
c) National security 

d) Allofthe above 
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Correct Response: 
d) All of the above 


Feedback when correct: 
That's right! You selected the correct response. 


Feedback when incorrect: 
You did not select the correct response. 
The correct response is: “All of the above. “ 


Potential damage to the nation includes: 
e Impact to IC’s ability to perform its mission 
e Damage to national security 


As well as: 
e Damage to IC’s capabilities 


e Benefit to adversaries wishing to harm the U.S. 


Potential damage to the IC employee includes: 
e Termination of employment 


As well as: 
e Revocation of security clearance 
e Criminal prosecution and associated penalties 
e Loss of pension and other retirement benefits 
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The purpose of the NdA is to create a lifetime contractual obligation to protect classified 
information. 


Select the correct response and select SUBMIT. 


O True 


© False 


3. The purpose of the NdA is to create a lifetime contractual obligation to protect classified 
information. 


a) True 
b) False 
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Correct Response: 
True 


Feedback when correct: 
That's right! You selected the correct response. 


The NdA creates a lifetime contractual obligation to protect classified information. The NdA specifically 
indicates that the failure to properly protect classified information may result in several criminal or 
administrative sanctions. 


Feedback when incorrect: 
You did not select the correct response. The correct response is True. 


The NdA creates a lifetime contractual obligation to protect classified information. It specifically 
indicates that the failure to properly protect classified information may result in several criminal or 
administrative sanctions. 
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Lesson 3: Summary 


A multitude of misconceptions swirl around the various laws created to protect the U.S. public 
“Journalists’ Privilege” does not allow reporters to protect their sources during grand jury proceedings. 
The Whistleblower Protection Act (WPA) and IC WPA are written to protect employees from direct 
retaliation for acts of whistleblowing, not to protect someone who unlawfully discloses classified 
information. A cleared employee who discloses classified information is not quaranteed protection 
under the First Amendment. The bottom line is that the disclosure of classified information to someone 
who is not authorized to receive it is a breach of trust and is also unlawful 


Five important responsibilities for all cleared employees are to sign an NdA, properly classify and 
handle sensitive information, report any suspected unauthorized disclosure of classified information, 
obtain proper authorization prior to communication with the media, and submit materials for a pre 
publication review prior to public se. Both administrative and criminal sanctions may apply if you 
fall to meet these responsibilities. Administrative sanctions include suspension without pay, revocation 
of clearance, snd termination of employment. Criminal sanctions include incarceration, fines, or loss of 
your federal retirement benefits. 


When you disclose classified information, you 
not only risk harming yourself, but also the 
nation, including 
* Damaging national security 
* Damaging IC capabilities 
* Impacting the IC's ability to perform its 
mission 
* Benefiting adversaries wishing to harm 
the U.S 


"As a journalist, I have only one responsibility and 
that is to get a story snd print it. It Isn't a question 
of justification in terms of the law, it's a question of 
justifying it in terms of the commercial sale of 
information to interested customers. That’s my only 
business. The only thing I do in life is to sell 
information, hopefully for a profit.” 


~ Lyle Denniston, Baltimore Sun (1984) 


Lesson 3: Summary 

A multitude of misconceptions swirl around the various laws created to protect the U.S. public. 
“Journalistic Privilege” does not allow reporters to protect their sources during grand jury proceedings. 
The Whistleblower Protection Act (WPA) and IC WPA are written to protect employees from direct 
retaliation for acts of whistleblowing, not to protect someone who unlawfully discloses classified 
information. A cleared employee who discloses classified information is not guaranteed protection 
under the First Amendment. The bottom line is that the disclosure of classified information to someone 
who is not authorized to receive it is a breach of trust and is also unlawful. 


Five important responsibilities for all cleared employees are to sign an NdA, properly classify and handle 
sensitive information, report any suspected unauthorized disclosure of classified information, obtain 
proper authorization prior to communication with the media, and submit materials for a pre-publication 
review prior to public release. Both administrative and criminal sanctions may apply if you fail to meet 
these responsibilities. Administrative sanctions include suspension without pay, revocation of clearance, 
and termination of employment. Criminal sanctions include incarceration, fines, or loss of your federal 
retirement benefits. 


When you disclose classified information, you not only risk harming yourself, but also the nation, 
including: 

e Damaging national security 

e Damaging IC capabilities 

e Impacting the IC’s ability to perform its mission 

e Benefiting adversaries wishing to harm the U.S. 


Call Out Box: 
“AS a journalist, | have only one responsibility and that is to get a story and print it. It isn’t a question of 
justification in terms of the law, it’s a question of justifying it in terms of the commercial sale of 
information to interested customers. That’s my only business. The only thing | do in life is to sell 
information, hopefully for a profit.” 

~Lyle Denniston, Baltimore Sun (1984) 
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Course Summary 


Congratulations! You have just completed the Unauthorized Disclosures of Classified Information 
course, This course covered many different facets of unauthorized disclosures and your 
responsibilities. 


An unauthorized disclosure is a communication or physical transfer of classified information to an 
unauthorized recipient. In order to become an authorized recipient you must have: 

* Obtained a favorable determination of eligibility for access 

* Executed an approved Non-disclosure Agreement (NdA) 

* Have a"“need-to-know” for the classified information 


Three classification levels have been established, based specifically on the level of damage to national 
security that would occur if the information were disclosed to an unauthorized person. One of the 
most common sources of unauthorized disclosures is leaks to the media - there are six identifiable 
categories of damage associated with media links. 


There are many misconceptions associated with unauthorized disclosure. Although there are various 
motivations and justifications related to unauthorized disclosure, it is never appropriate = 
unauthorized disclosure is a breach of trust, it is unlawful, and may result in administrative and 
criminal sanctions, By signing an NdA, you committed to properly classifying and handling sensitive 
Information, reporting any suspected unauthorized disclosures, obtaining proper authorization prior to 
communicating with the media, and submitting all material related to your position for pre-publication 
review prior to public release. 


It is Imperative that you remain vigilant in your efforts to avoid unauthorized disclosures to prevent 
damage to the nation and harm to yourself or your career 


If you have any concerns or questions, contact your SSO. If you suspect that an unauthorized 
disclosure has occurred, report it immediately using the approved channels. 


Course Summary 
Congratulations! You have just completed the Unauthorized Disclosures of Classified Information course. 
This course covered many different facets of unauthorized disclosures and your responsibilities. 


An unauthorized disclosure is a communication or physical transfer of classified information to an 
unauthorized recipient. In order to become an authorized recipient you must have: 

e Obtained a favorable determination of eligibility for access 

e Executed an approved Non-disclosure Agreement (NdA) 

e Have a “need-to-know” for the classified information 


Three classification levels have been established, based specifically on the level of damage to national 
security that would occur if the information were disclosed to an unauthorized person. One of the most 
common sources of unauthorized disclosures is leaks to the media — there are six identifiable categories 
of damage associated with media links. 


There are many misconceptions associated with unauthorized disclosure. Although there are various 
motivations and justifications related to unauthorized disclosure, it is never appropriate — unauthorized 
disclosure is a breach of trust, it is unlawful, and may result in administrative and criminal sanctions. By 
signing an NdA, you committed to properly classifying and handling sensitive information, reporting any 
suspected unauthorized disclosures, obtaining proper authorization prior to communicating with the 
media, and submitting all material related to your position for pre-publication review prior to public 
release. 


It is imperative that you remain vigilant in your efforts to avoid unauthorized disclosures to prevent 
damage to the nation and harm to yourself or your career. 


If you have any concerns or questions, contact your SSO. If you suspect that an unauthorized disclosure 
has occurred, report it immediately using the approved channels. 
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Additional Information 


Now that you have completed the course, you will be required to complete a short online exam. You 
will need to complete the exam in one sitting and you must receive an 80% or higher to receive credit 
for taking the course 


If you are an SSO or other security professional, you must also take the next course, Unauthorized 
Disclosures lassified Information - Supplement for Security Professionals. It will explore an IC 
employee'sresponsibilities in dealing with unauthorized disclosures. 


Please continue to the next slide to take your End of Course exam. 


Additional Information 

Now that you have completed the course, you will be required to complete a short online exam. You will 
need to complete the exam in one sitting and you must receive an 80% or higher to receive credit for 
taking the course. 

If you are an SSO or other security professional, you must also take the next course, Unauthorized 
Disclosures of Classified Information — Supplement for Security Professionals. It will explore an IC 
employee’s responsibilities in dealing with unauthorized disclosures. 

Please continue to the next slide to take your End of Course exam. 
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policy”). 

AUTHORITY: Michael S. Rogers, Admiral, U.S. Navy, Director, NSA/Chief, CSS 

ISSUED: 10 January 2018 

PURPOSE AND SCOPE 


1. In accordance with NSA/CSS Policy 1-52, “Classified National Security Information” 
(Reference a), this manual imposes special requirements to classify, declassify, safeguard, and 
mark classified national security information. It implements Reference a, Executive Order (EO) 
13526, “Classified National Security Information” (Reference b), and other implementing 
documents (References c—f). 


2. In implementing EO 13526 (Reference b), this manual reflects the principle that 
protecting information critical to national security and demonstrating commitment to open 
Government through accurate and accountable application of classification standards and 
routine, secure, and effective declassification are equally important priorities 
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ORIGINAL CLASSIFICATION 
Classification Standards 


3. Information may be originally classified only if all of the following conditions are met: 


a. An original classification authority (OCA) is classifying the information; 


b. The information is owned by, produced by or for, or under the control of the 
U.S. Government; 


c. The information falls under one or more of the following categories: 
1) military plans, weapons systems, or operations; 


2) foreign government information; 


3) intelligence activities (including covert action), intelligence sources or 
methods, or cryptology; 


4) foreign relations or foreign activities of the United States, including 
confidential sources 


5) scientific, technological, or economic matters relating to national 
security; 


6) U.S. Government programs for safeguarding nuclear materials or 
facilities; 
7) vulnerabilities or capabilities of systems, installations, infrastructures, 


projects, plans, or protection services relating to national security; or 


8) the development, production, or use of weapons of mass destruction; 
and 


d. The OCA determines that the unauthorized disclosure of the information 
reasonably could be expected to result in damage to national security and the OCA is 
able to identify or describe the damage. 


4. If there is significant doubt about the need to classify information, it shall not be 
classified. 


5. Classified information shall not be declassified automatically as a result of any 
unauthorized disclosure of identical or similar information. 


6. The unauthorized disclosure of foreign government information (FGI) is presumed to 
cause damage to national security. 
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Classification Levels 


7. Information may be classified at one of three levels based on the degree of damage to 
national security that reasonably could be expected if the information were disclosed without 
authorization. 


a. “TOP SECRET” shall be applied to information, the unauthorized disclosure of 
which reasonably could be expected to cause exceptionally grave damage to national 
security that the OCA is able to identify or describe; 


b. “SECRET” shall be applied to information, the unauthorized disclosure of 
which reasonably could be expected to cause serious damage to national security that the 
OCA is able to identify or describe; and 


c. “CONFIDENTIAL” shall be applied to information, the unauthorized 
disclosure of which reasonably could be expected to cause damage to national security 
that the OCA is able to identify or describe. 


8. If there is significant doubt about the appropriate level of classification, it shall be 
classified at the lower level. 


9. Information that is unclassified may be withheld from the public for one or more of the 
reasons cited in the Freedom of Information Act (FOIA) (Reference g), exemptions 2 through 9, 
and will be considered FOR OFFICIAL USE ONLY (FOUO). FOUO protection is afforded to 
information such as the names of NSA/CSS employees and certain missions and functions. This 
category of information may also be referred to as controlled unclassified information (CUD). 
Further guidance can be found in NSA/CSS Policy 1-5, “NSA/CSS Freedom of Information Act 
Program” (Reference h). 


Classification Authority 


10. Original classification is the initial determination that information requires, in the 
interest of national security, protection against unauthorized disclosure. Only an OCA may 
classify information originally. Within NSA/CSS, there are currently 16 individuals designated 
as OCAs (“go oca”). In the absence of an OCA, a person trained as an OCA and that the OCA 
designates in writing may act on his or her behalf. 


11. Original classification decisions are only required in those instances where the 
information is not covered by existing classification guidance such as is available in a 
classification guide or declassification guide, or any other form of documented OCA decision(s) 
(e.g., a decision documented in a Staff Processing Form (SPF)). 


12. An OCA decision may be made only by an OCA with jurisdiction over the 
information. For each original classification decision, the OCA must ensure that the information 
meets the standards for classification identified in the Classification Standards section and is not 
limited or prohibited from classification (see paragraph 26). The OCA determines the 
appropriate classification level (see the Classification Levels section), foreign releasability 
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instructions, and any other handling instructions or markings, and determines the duration of 
classification in accordance with the Duration of Classification section. OCA decisions must be 
coordinated with the Chief, Policy, Information, Performance, and Exports (PIPE) (P1), or 
designee, prior to implementation to ensure consistency with current guidance. 


13. When a person originates information he or she believes to require classification, the 
information shall be protected in a manner consistent with this guide. The information shall be 
provided promptly to an OCA with purview over the information. The OCA shall decide within 
30 days whether to classify the information. 


Duration of Classification 


14. Except for information that should clearly and demonstrably be expected to 
reveal the identity of a confidential human source or a human intelligence source or key 
design concepts of weapons of mass destruction, an OCA shall follow the sequence in this 
section when determining the duration of classification of originally classified information. 


a. The OCA shall attempt to determine a date or event that is less than 10 years 
from the date of original classification and which coincides with the lapse of the 
information’s national security sensitivity, and shall assign such date or event as the 
declassification instruction. 


b. If unable to determine a date or event of less than 10 years, the OCA shall 
ordinarily assign a declassification date that is 10 years from the date of the original 
classification decision. 


c. If unable to determine a date or event of 10 years, the OCA shall assign a 
declassification date not to exceed 25 years from the date of the original 
classification decision. Note: With very few exceptions, most NSA/CSS OCA 
decisions have a declassification date of “Current date plus 25 years.” 


d. In those rare cases where NSA/CSS has been granted an exemption, the 
OCA will assign a declassification date that is 50 years from the date of the original 
classification decision. See paragraph 42.a.2. 


15. Extensions of classification are not automatic. 


a. If the date or event assigned by an OCA has not passed, an OCA with 
jurisdiction over the information may extend the classification duration of such 
information for a period not to exceed 25 years from the date or origin of the record. 


b. If the date or event assigned by the OCA has passed, an OCA with 
jurisdiction over the information may reclassify the information in accordance with 
EO 13526 (Reference b). 


c. When extending the duration of classification, the OCA must be an OCA 
with jurisdiction over the information, ensure that the information continues to meet 
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the standards for classification as stated in the Classification Standards section, and 
make reasonable attempts to notify all holders of the information. 


16. Unless declassified earlier or the duration of classification has been extended as 
described in paragraph 15, information marked with a specific date or event for 
declassification is subject to automatic declassification (see paragraph 42.a). 


17. No information may remain classified indefinitely. Information marked for an 
indefinite duration of classification under predecessor orders, or classified information that 
contains incomplete declassification instructions or lacks declassification instruction shall 
be declassified in accordance with the automatic declassification provisions of EO 13526 
(Reference b). Declassification Services (P133) manages this function for NSA/CSS. 


Identification and Markings 


18. At the time of original classification, the following shall be indicated in a manner that 
is immediately apparent: 


a. One of the three classification levels defined in paragraph 7; 
b. The identity, by name and position, or by personal identifier, of the OCA 
c. The agency and office of origin, if not otherwise evident; 


d. Declassification instructions, which shall indicate a date consistent with 
guidance in paragraph 14. 


e. A concise reason for classification that, at a minimum, cites the applicable 
classification categories in paragraph 3.c. 


19. Specific information required by paragraph 18 may be excluded if it would reveal 
additional classified information. 


20. The originator of a document shall, by marking or other means, indicate which 
portions are classified (with the appropriate classification level) and which portions are 
unclassified. 


21. See Annex A for additional guidance on marking. 


22. Foreign government information (FGI) shall retain its original classification 
markings or shall be assigned a U.S. classification that provides a degree of protection at 
least equivalent to that required by the entity that furnished the information. FGI retaining 
its original classification markings need not be assigned a U.S. classification marking 
provided that the responsible agency determines that the foreign government markings are 
adequate to meet the purposes served by U.S. classification markings. Details on marking 
FGI can be found in References e and f. 
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23. Information assigned a level of classification under this or predecessor orders 
shall be considered as classified at that level of classification despite the omission of other 
required markings. Whenever such information is used in the derivative classification process 
or is reviewed for possible declassification, holders of such information shall coordinate 
with an appropriate classification authority for the application of omitted markings. 


24. The classification authority shall, whenever practicable, use a classified 
addendum whenever classified information constitutes a small portion of an otherwise 
unclassified document or prepare a product to allow for dissemination at the lowest level of 
classification possible or in an unclassified form. 


25. Prior to public release, all declassified records shall be appropriately marked to 
reflect their declassification. 


Classification Prohibitions and Limitations 


26. In no case shall information be classified, continue to be maintained as classified, or 
fail to be declassified in order to: 


a. Conceal violations of law, inefficiency, or administrative error; 
b. Prevent embarrassment to a person, organization, or agency; 
c. Restrain competition; or 


d. Prevent or delay the release of information that does not require protection in 
the interest of national security. 


27. Basic scientific research information not clearly related to national security shall not 
be classified. 


28. Information may not be reclassified after declassification and release to the public 
under proper authority unless it meets the criteria in section 1.7(c) of EO 13526 (Reference b). 


29. Information that has not previously been disclosed to the public under proper 
authority may be classified or reclassified after an agency has received a request for it under the 
FOIA (Reference g), the Presidential Records Act (Reference i), the Privacy Act (Reference J), 
or the mandatory declassification review process (Reference k). This may only occur if such 
classification meets the requirements in this policy and is accomplished on a document-by- 
document basis with the personal involvement of the Senior Agency Official (SAO). The 
requirements of this paragraph also apply to those situations in which information has been 
declassified in accordance with a specific date or event determined by an OCA in accordance 
with the Duration of Classification section. 
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Compilation of Information 


30. A compilation of items of information that are individually unclassified may be 
classified if the compiled information reveals an additional association or relationship that meets 
the standards for classification (Classification Standards) and is not otherwise revealed in the 
individual items of information. Similarly, a compilation of items of classified information may 
be classified at a higher level if the compiled information reveals an additional association or 
relationship that meets the standards for classification and is not otherwise revealed in the 
individual items of classified information. 


31. A compilation of items of information that are individually unclassified may be 
marked as UNCLASSIFIED//FOR OFFICIAL USE ONLY if the compiled information may be 
withheld for one or more of the reasons cited in exemptions 2 through 9 of the FOIA (Reference 


2). 
DERIVATIVE CLASSIFICATION 


Use of Derivative Classification 


32. Persons who reproduce, extract, or summarize classified information, or who apply 
classification markings derived from source material or as directed by a classification guide, 
need not possess original classification authority. In the process of assigning a derivative 
classification, a derivative classifier will refer to original classification guidance (e.g., an 
NSA/CSS classification or declassification guide, an OCA decision documented in an SPF) or a 
previously classified document that accurately reflects an OCA decision. 


33. Derivative classifiers shall: 


a. Be identified by name and position, or by personal identifier, in a manner 
that is immediately apparent for each derivative classification action; 


b. Observe and respect original classification decisions; 


c. Carry forward to any newly created document the pertinent classification 
markings from the source document(s) or applicable classification guide(s); 


d. Carry forward the date for declassification that corresponds to the longest 
period of classification among the sources; and 


e. List the source documents. 
34. See Annex A for additional guidance on marking. 


35. Derivative classifiers shall, whenever practicable, use a classified addendum 
whenever classified information constitutes a small portion of an otherwise unclassified 
document or prepare a product to allow for dissemination at the lowest level of 
classification possible or in an unclassified form. 
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Classification Guides 


36. Agencies with original classification authority must prepare classification guides and 
declassification guides to facilitate the proper and uniform derivative classification of 
information. Information and guidance on creating NSA/CSS classification guides can be found 
in Annex B. 


37. The absence of an item in a classification guide does not imply it is unclassified. 
If a holder of information believes the information should be classified but it is not covered 
by aclassification guide, or a compilation of unclassified information should be classified, 
or information already classified should be classified at a higher level, the individual should 
handle and safeguard the information accordingly, tentatively mark the information along 
with the notation “pending classification review by [title of the appropriate OCA],” and 
contact the local Classification Advisory Officer (CAO) and or Information 
Security/Classification (P131) for further guidance. 


Sensitive Compartmented Information 


38. The term “Sensitive Compartmented Information” (SCI) refers to classified 
information concerning or derived from intelligence sources, methods, or analytical processes 
that is required to be handled within formal control systems established by the Director of 
National Intelligence (DNI). The term “SCI control system” refers to the system of procedural 
protective mechanisms used to regulate or guide each program established by the DNI as SCI. A 
control system provides the ability to exercise restraint, direction, or influence over or provide 
that degree of access control or physical protection necessary to regulate, handle, or manage 
information or items within an approved program. Within the SCI control systems are 
compartments and sub-compartments, each designed to formally segregate data and limit access 
to those with an absolute need-to-know as determined by a central authority for each 
compartment. Three SCI compartments most commonly used at NSA/CSS are: 


a. Special Intelligence (SI) protects technical and intelligence information derived 
from the monitoring of foreign communications signals by other than the intended 
recipients. The SI control system protects SI-derived information and information 
relating to SI activities, capabilities, techniques, processes, and procedures!; 


b. HUMINT (Human Intelligence) Control System (HCS) protects the most 
sensitive HUMINT operations and information acquired from clandestine and/or 
uniquely sensitive HUMINT sources, methods, and certain technical collection 
capabilities, technologies, and methods linked to or supportive of HUMINT; and 


c. TALENT KEYHOLE (TK) protects information and activities related to space- 
based collection of imagery, signals, measurement and signature intelligence, certain 


! The “COMINT” (i.e., Communications Intelligence) title for the SI control system is no longer valid. 
Any COMINT information formerly protected by now-defunct COMINT marking or COMINT code words is 
protected as SI. 
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products, processing, and exploitation techniques, and the design, acquisition, and 
operation of reconnaissance satellites. 


DECLASSIFICATION AND DOWNGRADING 
Authority for Declassification 


39. Information shall be declassified as soon as it no longer meets the standards for 
classification (Classification Standards). Decisions concerning the declassification or 
downgrading of information will be made by a declassification authority (generally, the OCA 
with purview over that information). When practicable, this will be the same OCA who 
originally classified the information, that OCA’s successor, or a supervisor of the OCA or 
successor OCA — if that person has the authority to originally classify information, or by an 
official delegated declassification authority in writing by DIRNSA/CHCSS or by the Chief, PIPE 
(in the capacity of the SAO). 


40. The DNI may, in consultation with DIRNSA/CHCSS, declassify, downgrade, or 
direct the declassification or downgrading of information or intelligence relating to 
intelligence sources, methods, or activities relevant to NSA/CSS. 


41. While it is presumed that classified information requires continued protection, in 
exceptional circumstances the need to protect such information may be outweighed by the 
public interest in disclosure of the information and should be declassified. The Chief, PIPE, 
in consultation with an OCA with purview over the information, shall make such a determination 
considering, among other factors, whether the public interest in disclosure outweighs the damage 
to national security that might reasonably be expected from disclosure. 


Declassification Programs 


42. Declassification Services (P133) manages the automatic declassification program, the 
systematic declassification review program, and the Mandatory Declassification Review (MDR) 
program for NSA/CSS. 


a. Automatic Declassification: 


1) All classified records that are more than 25 years old, have been 
determined to have permanent historical value under Title 44, United States Code 
(USC), and have not been identified as exempt shall be automatically declassified, 
whether or not the records have been reviewed. All classified non-exempt records 
will be automatically declassified on 31 December of the year that is 25 years 
from the date of origin. 


2) Exemptions from automatic declassification approved in accordance 
with EO 13526 (Reference b) may be incorporated into classification guides 
provided the Interagency Security Classification Appeals Panel (ISCAP) is 
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notified in advance of the intent to take such action and the exempted information 
remains in active use. 


b. Systematic Declassification Review: NSA/CSS conducts a program for 
systematic declassification review of records of permanent historical value exempted 
from automatic declassification. 


c. MDR: Individuals may request an MDR of classified government records; 
see Policy 1-15, “Mandatory Declassification Review Program” (Reference k), for 
details. 


43. NSA/CSS shall take all reasonable steps to declassify classified information 
contained in records determined to have permanent historical value before they are 
accessioned into the National Archives. However, the Archivist may require that classified 
records be accessioned into the National Archives when necessary to comply with the 
Federal Records Act (Reference 1). 


CLASSIFICATION CHALLENGES 
General Procedures 


44. Authorized holders of information who, in good faith, believe that its classification 
status is improper (e.g., the information is marked unclassified but the holder believes it should 
be classified, or an item is marked TOP SECRET but the holder believes it should be 
CONFIDENTIAL) are encouraged and expected to challenge the classification status of the 
information. 


45. No punitive action will be taken against an authorized holder who, in good faith, 
makes a classification challenge. 


46. Information involved in a classification challenge shall continue to be protected at the 
level of its current classification level until a final decision is made on the challenge. 


47. These procedures do not apply to documents that are required to be submitted for 
prepublication review (Reference m) or in an administrative process pursuant to an approved 
nondisclosure agreement. 


48. NSA/CSS will not entertain classification challenges of information that has been the 
subject of a classification challenge within the past 2 years (including information that has been 
the subject of a FOIA or Privacy Act (References g and j) request or MDR request (Reference k) 
within the past 2 years), or that is the subject of pending litigation. Such requests will not be 
processed beyond informing the requester of this fact and of his/her appeal rights, if any. 


Procedures for Submitting a Classification Challenge 


49. Informal Classification Challenges: While not a required step in the classification 
challenge process, informal challenges to the classification status of a particular piece of 
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information are encouraged. Such challenges may take any number of different forms, but the 
relevant classified information must at all times be handled and protected in a manner that 
accords with EO 13526 unless and until a final decision is made to declassify it. Informal 
questions may be directed to the originator/owner of the information and/or the local CAO. The 
list of NSA/CSS CAOs is available by typing “go cao” on NSA Web. 


50. Formal Classification Challenges: An authorized holder who wants to formally 
challenge the classification status of such information shall: 


a. Present a challenge to the OCA with purview over the information and to 
Information Security/Classification (P131) for tracking. The formal challenge must be in 
writing but need not be any more specific than to question why the information is or is 
not classified or why it is classified at a certain level. Upon receipt, the formal challenge 
shall be entered into the P131 system for processing, tracking, and recording formal 
classification challenges made by authorized holders. 


b. The OCA with purview over the information shall review the challenge and 
provide an initial written response to a challenge within 60 days. 


1) If the OCA is unable to review the challenge and respond within 60 
days, the Agency must acknowledge the challenge in writing and provide the 
challenger with a date by which such a determination will be made. The 
acknowledgement shall also include a statement that, if no response is received 
within 120 days of the original notification, the challenger has the right to forward 
the challenge to the ISCAP for a decision. 


2) If the OCA fails to provide an initial written response to a classification 
challenge within 120 days from the original notification, the challenger may 
forward the challenge to the ISCAP for a decision. 


3) If the OCA issues an adverse determination of a classification 
challenge, the determination shall include notification that the challenger has the 
right to submit an internal administrative appeal within 60 days of the date of the 
adverse determination to the Chief, PIPE. 


c. The Chief, PIPE shall normally make a determination within 60 working days 
following the receipt of an appeal. 


1) If additional time is required to make a determination, the Chief, PIPE 
shall notify the challenger of the additional time needed and provide the requester 
with the reason for the extension. 


2) The Chief, PIPE shall notify the challenger in writing of the final 
determination, and, in the case of a denial, of the reason for the denial and of the 
challenger’s final appeal rights to the ISCAP. 
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3) If the Agency fails to respond to the challenger within 90 days of the 
Agency’s receipt of the appeal, the challenger may forward the challenge to the 
ISCAP. 


Safeguarding 


51. An official or employee leaving Agency service may not remove classified 
information from the Agency’s control or direct that information be declassified in order to 
remove it from Agency control. 


52. Classified information may not be removed from official premises without proper 
authorization. 


53. Persons authorized to disseminate classified information outside the Executive 
Branch shall ensure the protection of the information in a manner equivalent to that provided 
within the Executive Branch. 


54. Consistent with this Guide and other relevant guidance, controls shall be established 
to ensure that classified information is used, processed, stored, reproduced, transmitted, and 
destroyed under conditions that provide adequate protection and prevent access by unauthorized 
individuals. In accordance with EO 13587, “Structural Reforms to Improve the Security of 
Classified Networks and the Responsible Sharing and Safeguarding of Classified Information” 
(Reference n), this includes information sharing and safeguarding of classified information on 
computer networks. 


55. NSA/CSS shall safeguard FGI under standards that provide a degree of protection at 
least equivalent to that required by the government or international organization of governments 
that furnished the information. When adequate to achieve equivalency, these standards may be 
less restrictive than the safeguarding standards that ordinarily apply to U.S. CONFIDENTIAL 
information, including modified handling and transmission and allowing access to individuals 
with a need-to-know who have not otherwise been cleared for access to classified information or 
executed an approved nondisclosure agreement. 


56. Policy on special access programs can be found in NSA/CSS Policy 1-41, “Programs 
for the Protection of Especially Sensitive Classified Information” (Reference 0). 


57. Individuals suspecting an unauthorized disclosure of NSA/CSS information should 
report it in accordance with NSA/CSS Policy 1-27, “Reporting Unauthorized Media Disclosures 
of Classified NSA/CSS Information” (Reference p), NSA/CSS Policy 5-5, “Reporting of 
Security Incidents and Criminal Violations” (Reference q), or NSA/CSS Policy 5-21, “Individual 
Security Reporting Requirements” (Reference r), as appropriate. 


Self-Inspection Program 


58. Pursuant to EO 13526 (Reference b) and EO 13587 (Reference n), heads of agencies 
that originate or handle classified information are required to establish and maintain an ongoing 
self-inspection program that shall include the regular review and assessment of the Agency’s 


14 
UNCLASSIFIED 


564 


565 


565 


UNCLASSIFIED 
Policy Manual 1-52 8 January 2021 


Information Security Program. The purpose of a self-inspection is to review and assess an 
organization’s classified product and its procedures for protecting that product. 


59. The SAO directs and administers the Agency’s self-inspection program through P131 
and CAOs Agency-wide. The program provides the SAO with information necessary to assess 
the effectiveness of the classified national security information program within individual 
activities and in the Agency as a whole (Reference c). Self-inspections evaluate adherence to 
References b and c and the effectiveness of Agency programs addressing original classification, 
derivative classification, declassification, safeguarding, security violations, security education 
and training, and management and oversight. 


60. The self-inspection of an NSA/CSS element consists of three parts: 


a. Review of a random sampling of classified materials (e.g., email, reports, 
presentations, and webpages) to gauge organizational proficiency in marking mechanics 
and a security review; 


b. Interviews of organization personnel to assess typical attitudes and awareness 
relative to classification policy and information handling issues; and 


c. Information Security program discussions with the organizational CAO to 
document additional issues, review a sampling of CAO correspondence, and provide 
recommendations and resources that could lead to a stronger program. 


61. For additional information on items that will be addressed during self-inspections, see 
the “NSA/CSS Information Security and Self-Inspection Program Evaluation Checklist” and the 


“NSA/CSS Information Security Self-Inspection Program Standard Operating Procedures” 
(Reference s). 
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z. Chief Data Officer (CDO) Directive 2016-001, Requirement to use the “FISA” Dissemination 
Control Marking on all FISA data, dated 14 October 2016 


aa. Information Sharing Services/Reporting Policy Guidance (ISS/RPG)-019-14 (Change 3), 
[protected title], dated 10 November 2014 


bb. ISS/RPG-034-14 (Change 1), [protected title], dated 30 December 2014 


cc. Office of the National Counterintelligence Executive (NCIX) 260-11, “DNI Guidance for 
Intelligence Community Marking Challenge Procedures,” dated 18 January 2012 


dd. DoDM 5200.45, “Instructions for Developing Security Classification Guides,” dated 2 April 
2013 


ee. “NSA/CSS Declassification Guide” dated 14 September 2012 


GLOSSARY 
access—The ability or opportunity to gain knowledge of classified information (Reference b). 
authorized holder—A person who may have access to classified information provided that:on: 


a. A favorable determination of eligibility for access has been made by an agency head or 
the agency head’s designee; 


b. The person has signed an approved nondisclosure agreement; and 
c. The person has a need to know the information. 

automatic declassification—the declassification of information based solely upon: 
a. The occurrence of a specific date or event as determined by the OCA; or 


b. The expiration of a maximum timeframe for duration of classification established 
under EO 13526 (Reference b). 


classification—The act or process by which information is determined to be classified 
information (Reference b). 


classification guide—A documentary form of classification guidance issued by an original 
classification authority that identifies the elements of information regarding a specific subject 
that must be classified and establishes the level and duration of classification for each such 
element (Reference b). 


classified national security information—Information that has been determined to require 
protection against unauthorized disclosure and is marked to indicate its classified status when in 
documentary form. 
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classify—See classification. 


damage to national security—Harm to the national defense or foreign relations of the U.S. 
from the unauthorized disclosure of information, taking into consideration such aspects of the 
information as the sensitivity, value, utility, or provenance of that information. 


declassification—The authorized change in the status of information from classified information 
to unclassified information (Reference b). 


declassification guide—Written instructions issued by a declassification authority that describes 
the elements of information regarding a specific subject that may be declassified and the 
elements that must remain classified (Reference b). 


declassify—See declassification. 


derivative classification—Incorporating, paraphrasing, restating, or generating in new form 
information that is already classified and marking the newly developed material consistent with 
the classification markings that apply to the source information. Derivative classification 
includes the classification of information based on classification guidance. The duplication or 
reproduction of existing classified information is not derivative classification. 


downgrading—A determination by a declassification authority that information classified and 
safeguarded at a specified level shall be classified and safeguarded at a lower level. 


foreign government information—1) Information provided to the U.S. Government by a 
foreign government or governments, an international organization of governments, or any 
element thereof, with the expectation that the information, the source of the information, or both 
are to be held in confidence; (2) information produced by the U.S. Government pursuant to or as 
a result of a joint arrangement with a foreign government or governments, or an international 
organization of governments, or any element thereof, requiring that the information, the 
arrangement, or both are to be held in confidence; or (3) information received and treated as 
“foreign government information” under the terms of a predecessor order. 


intelligence—Foreign intelligence and counter intelligence as defined in EO 12333 (Reference 


9. 


intelligence activities—All activities that elements of the Intelligence Community are 
authorized to conduct pursuant to EO 12333 (Reference t). 


mark—See marking. 
marking—lIdentifying the classification of information (Reference f). 


multiple sources—Two or more source documents, classification guides, or a combination of 
both. 
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need-to-know—A determination within the Executive Branch in accordance with directives 
issued pursuant to this order that a prospective recipient requires access to specific classified 
information in order to perform or assist in a lawful or authorized governmental function. 


original classification—An initial determination that information requires, in the interest of 
national security, protection against unauthorized disclosure. 


Original Classification Authority (OQCA)—An individual authorized in writing, either by the 
President, the Vice President, or by agency heads or other officials designated by the President, 
to classify information in the first instance. 


Personally Identifiable Information—Information about an individual that can be used to 
uniquely and reliably identify a person and information which is linkable to a specific individual. 


safeguarding—Measures and controls that are prescribed to protect classified information. 


sanitization—The process of editing or otherwise altering intelligence information or reports to 
protect sensitive intelligence sources and methods, capabilities, and analytical procedures in 
order to permit wider dissemination. 


senior agency official—The official designated by the agency head to direct and administer the 
agency’s program under which information is classified, safeguarded, and declassified. At 
NSA/CSS this is the Chief, Policy, Information, Performance, and Exports. 


source document—An existing document that contains classified information that is 
incorporated, paraphrased, restated, or generated in new form into a new document. 


ACRONYMS 
CAO Classification Advisory Officer 
CAPCO Controlled Access Program Coordination Office 
CD ROM compact disc read-only memory 
CDO Chief Data Officer 
COMINT Communications Intelligence 
CUI controlled unclassified information 
DNI Director of National Intelligence 
DoD Department of Defense 
DoDM Department of Defense Manual 
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EO 

FGI 
FISA 
FOIA 
FOUO 
HCS 
HUMINT 
IC 

ICD 
ICPG 
IMI 
ISCAP 
ISOO 
ISS/RPG 
MDR 
MR 
NCIX 
NDP-1 
NOFORN 
OADR 
OCA 
ODNI 


ONCIX/SSD 


ORCON 
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Executive Order 

Foreign Government Information 

Foreign Intelligence Surveillance Act 
Freedom of Information Act 

FOR OFFICIAL USE ONLY 

HUMINT Control System 

Human Intelligence 

Intelligence Community 

Intelligence Community Directive 
Intelligence Community Policy Guidance 
Information Management Instruction 
Interagency Security Classification Appeals Panel 
Information Security Oversight Office 
Information Sharing Services/Reporting Policy Guidance 
Mandatory Declassification Review 

manual review 

National Counterintelligence Executive 
National Disclosure Policy 

not releasable to foreign nationals 

originating agency’s determination required 
Original Classification Authority 

Office of the Director of National Intelligence 


Office of the National Counterintelligence Executive 
Special Security Directorate 


Originator Controlled 
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PDF 
PII 
PIPE 


REL TO [USA, LIST] 
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portable document format 


personally identifiable information 


Policy, Information, Performance, and Exports 


authorized for release to [USA, LIST] 


RELIDO releasable by information disclosure official 
SAO Senior Agency Official 
SCI sensitive compartmented information 
SFDRA Senior Foreign Disclosure and Release Authority 
SI special intelligence 
SIPRNet Secret Internet Protocol Network 
SPF staff processing form 
TK TALENT KEYHOLE 
URL uniform resource locator 
USB universal serial bus 
USC United States Code 
USCS United States Cryptologic System 
DOCUMENT HISTORY 
Date Approved by Description 
10 January 2018 Michael S. Rogers, Policy issuance; supersedes NSA/CSS 
Admiral, U.S. Navy, Policy Manual 1-52, dated 2 June 2015 
Director, NSA/Chief, CSS 
4 January 2019 Chief, Policy Administrative update to change SPP to 
PIPE and clarify the requirements for 
classification guidance 
13 September 2019 | Chief, Policy Administrative update to incorporate 
accessibility enhancements 
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Date Approved by Description 
8 January 2021 Chief, Policy Information, Administrative update to remove the 
Performance, and Exports requirement of Classification Advisory 
Officer reviews in NSA/CSS processes 
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ANNEX A: 
MARKING GUIDANCE 


General 


1. EO 13526 (Reference b) prescribes a uniform system for classifying, safeguarding, and 
declassifying national security information while allowing public access when possible. This 
uniform system requires that standard markings be applied to classified and declassified 
information, and markings not deviate from prescribed formats. The Office of the Director of 
National Intelligence (ODNI) and the Department of Defense (DoD) provide consistent 
standards for a uniform list of authorized classification and control markings and their authorized 
abbreviations and portion markings pursuant to EO 13526 and Information Security Oversight 
Office (SOO) Implementing Directive (References b and c). 


2. Intelligence Community (IC) authorized classification and control marking guidance is 
provided in the Intelligence Community Markings System Register and Manual (Reference e). 
DoD guidance for marking classified military information is contained in DoD Manual (DoDM) 
5200.01, Volume 2 (Reference f). This Annex provides marking guidance common to both DNI 
and DoD. See Appendix 1 for marking guidance unique to DNI. See Appendix 2 for information 
unique to DoD. 


3. Marking guidance in this manual is applicable to all information under the purview of 
the NSA/CSS Cryptologic Enterprise; however, it cannot describe every possible situation that 
might arise and there will be times when this guidance will need to be applied in a flexible 
manner. At times when no marking guidance exists, the spirit of EO 13526 and the SOO 
Implementing Directive (References b and c) shall be followed in a manner that best safeguards 
the information. 


4. If classification and control markings cannot be affixed to specific classified 
information or materials, the OCA shall provide written instructions for protecting the 
information. Similarly, if declassification markings cannot be affixed to specific information or 
materials, the OCA shall provide holders or recipients of the information with written 
instructions for marking the information. 


5. The classification and/or control markings on legacy information do not have to 
immediately be re-marked to reflect guidance in this manual. Such information must be re- 
marked with an updated classification and/or control marking upon its subsequent use or further 
dissemination. Additional guidance on legacy classification or control markings can be found by 


typing “go legacy-markings” on NSA Web. 
Original Classification 


6. Markings shall be uniformly and conspicuously applied to leave no doubt about the 
classified status of the information, the level of protection required, and the duration of 
classification. 


A-1 
UNCLASSIFIED 


574 


UNCLASSIFIED 
Annex A to Policy Manual 1-52 8 January 2021 


7. At the time of original classification, the following shall be indicated in a manner that 
is immediately apparent: 


a. Classification Authority: the name and position or the personal identifier of the 
OCA shall appear on the “Classified By” line. If not otherwise evident, the agency and 
office of origin shall be identified and follow the name of the OCA. 


b. Reason for classification: the OCA shall identify the reason(s) for the decision 
to classify on the “Reason” line. Include on this line the number 1.4 plus the letter(s) that 
corresponds to that classification category in paragraph 3.c of this policy. 


c. Declassification instructions: The duration of the original classification 
decision shall be placed on the “Declassify On” line. When declassification dates are 
displayed numerically, the following format shall be used: YYYYMMDD. Events shall 
be reasonably definite and foreseeable, such as Completion of Operation. The OCA will 
apply a duration consistent with paragraph 14 of this policy. 


d. An example of an original classification block might appear as: 


Classified By: dwsmith, Chief, Support Services 
Reason: 1.4(d) 
Declassify On: 20350530 


Or 


Classified By: David W. Smith, Chief, Support Services 
Reason: 1.4(d) 
Declassify On: Completion of project 


e. The date of origin of the document. 
Derivative Classification 


8. Derivative classification markings shall be carried forward from the source document 
or taken from instructions in the appropriate classification guide. 


9. A classification authority block must be clearly identified and include the following: 


a. “Classified By” line indicating the individual doing the derivative 
classification. Either the individual’s SID or employee identification number may be 
used; 


b. “Derived From” line indicating the source of the classification determination; 


c. “Dated” line indicating, in YYYYMMDD format, the date of the source 
document or classification guide in the “Derived From” line; and 
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d. “Declassify On” line indicating the declassification instructions for the 
document. For most NSA/CSS information the declassification date is 25 years from the 
date a document is created. If the declassification instruction is a date, the format is 
YYYYMMDD. 


10. Derivative classifiers shall be identified by name and position, or by personal 
identifier, in a manner that is immediately apparent on each derivatively classified document. If 
not otherwise evident, the agency and office of origin shall be identified and follow the name on 
the “Classified By” line. An example might appear as 

Classified By: Peggy G. Jones, Lead Analyst 
or 
Classified By: pgjones 

11. The derivative classifier shall concisely identify the source document or the 
classification guide on the “Derived From” line, including the agency and, where available, the 
office of origin, and the date of the source or guide. An example might appear as 

Derived From: Memo, “SUGARHONEY Preparations,” NSA/CSS, SID 
or 


Derived From: NSA/CSS SUGARHONEY Classification Guide 


12. When a document is classified derivatively on the basis of more than one source 
document or classification guide, the derivative classifier shall include a listing of the source 
materials on, or attached to, each derivatively classified document and the “Derived From” line 
shall appear as: 


Derived From: Multiple Sources 


13. The derivative classifier shall carry forward the “Declassify On” line from the source 
document to the derivative document, or the duration instruction from the classification or 
declassification guide. If the source document is missing the declassification instruction, then a 
calculated date of 25 years from the date of the source document or the current date (if the source 
document date is not available) shall be carried forward by the derivative classifier. 


14. When a document is classified derivatively on the basis of multiple documents, the 
“Declassify On” line shall reflect the longest duration of any of its sources. When a document is 
classified derivatively either from a source document or classification guidance that contains 
either declassification instructions Originating Agency’s Determination Required, “OADR,” 
Manual Review, “MR,” or any of the exemption markings (i.e., X1, X2, etc.), the derivative 
classifier shall calculate a date that is 25 years from the date of the source document when 
determining a derivative document’s date to be placed in the “Declassify On” line. 


15. Sample classification authority block: 
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Classified By: pgjones 

Derived From: NSA/CSS SUGARHONEY Classification Guide 
Dated: 20170529 

Declassify On: 20420529 


Primary Markings 


16. Overall Marking. The highest level of classification is determined by the highest level 
of any one portion within the document. Place the overall classification at the top and bottom of 
the outside of the front cover (if any), on the title page (if any), on the first page, and on the 
outside of the back cover (if any). The overall classification and control marking string is 
referred to as the “banner line.” 


a. For documents containing information classified at more than one level, the 
banner line shall be the aggregate of the highest level of classification and the most 
restrictive control marking(s). For example, if a document contains some information 
marked “SECRET//NOFORN” and other information marked 
CONFIDENTIAL//SI//REL TO USA, FVEY,” the banner line would be 
“SECRET//SI//NOFORN.” 


b. Each interior page of a classified document shall be marked at the top and 
bottom with either the highest overall classification of the information on that page or the 
highest overall classification of the document, preferably the latter. 


17. Portion Marking. Each portion of a document, ordinarily a paragraph, but including 
subjects, titles, graphics, tables, charts, bullet statements, subparagraphs, signature blocks, 
bullets, and other portions within slide presentations, shall be marked to indicate which portions 
are classified and which portions are unclassified by placing a parenthetical symbol immediately 
preceding the portion to which it applies. Each portion marking shall indicate the highest 
classification level and control of information contained within the specific portion. Portion 
marking is not required if a document comprises completely unclassified information. However, 
if a single portion is classified or requires dissemination controls (e.g., U//FOUO), then the entire 
document must be portion marked. References e and f provide detailed guidance on portion 
marking. 


a. To indicate the appropriate classification level, the conventions “(TS)” for Top 
Secret, “(S)” for Secret, and “(C)” for Confidential will be used. Portions that do not meet 
the standards for classification shall be marked with “(U)” for Unclassified or 
“(U//FOUO)” for Unclassified//For Official Use Only to indicate Personally Identifiable 


Information (PII) or CUI. 


b. In cases where portions are segmented, such as paragraphs, subparagraphs, 
bullets, or sub-bullets, and the classification level is the same throughout, it is sufficient 
to put only one portion marking at the beginning of the main paragraph or main bullet. If 
there are different levels of classification among these segments, then all segments shall 
be portion marked separately in order to avoid over-classification of any one segment. 


A-4 
UNCLASSIFIED 


UNCLASSIFIED 
Annex A to Policy Manual 1-52 8 January 2021 


c. If the information contained in a subparagraph or sub-bullet is a higher level of 
classification than its parent paragraph or parent bullet, this does not make the parent 
paragraph or parent bullet classified at the same level. Each portion shall reflect the 
classification level of that individual portion and not any other portion(s). 


d. Uniform Resource Locators (URLs) shall be portion marked based on the 
classification of the content of the URL itself. The URL shall not be portion marked to 
reflect the classification of the content to which it points. For clarity, a notice may be 
included after a link to indicate that it will take the reader to a classified document, for 
example: 


(U) Link to Final Report (Report is TOP SECRET) 


or 


http://www.proj.nsa.ic.gov/centerdub_(TS).html 


e. Portion markings shall include any control markings applicable to the portion. 


18. Control Markings. Control markings are used in the overall classification line and 
portion marking to identify control systems that provide additional access control or physical 
protection for the information or items covered by the program (e.g., SCI) or to identify the 
expansion or limitation on the distribution of information (i.e., dissemination controls). These 
markings are in addition to and separate from the levels of classification (e.g., TOP SECRET, 
SECRET, CONFIDENTIAL). See Appendix A-1 and Appendix A-2 for additional guidance. 


19. Within the portion marking and banner line, double forward slashes (//) separate the 
classification and control markings and also separate the categories of control markings. Single 
forward slashes (/) separate multiple control markings within the same category. Hyphens (-) are 
used to separate control markings and their sub-controls (see Table 1). 


Table 1: Examples of Markings 


UNCLASSIFIED — CLASSIFICATION MARKINGS FOR ILLUSTRATION PURPOSES 
ONLY 


Banner Line Portion Marking 


TOP SECRET//SI/TK//REL TO USA, AUS (TS//SI/TK//REL) 
where the overall dissemination control 
marking for the whole document is REL TO 


USA, AUS 
SECRET//SI/TK//RELIDO (S//SI/TK//RELIDO) 
TOP SECRET//SI- (TS//SI-G//OC/NF) 
GAMMA//ORCON/NOFORN 
CONFIDENTIAL//REL TO USA, FVEY (C//REL TO USA, FVEY) 
UNCLASSIFIED//FOR OFFICIAL USE (U//FOUO) 
ONLY 
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Transmittal Documents 


20. Transmittal documents are documents that have information enclosed with or 
attached to them. An example is a letter, memorandum, or summary sheet with enclosures. The 
transmittal document itself may or may not be classified and may or may not contain classified 
information. 


21. If the transmittal document does not contain classified information, mark the banner 
line at the top and bottom of each page with the highest classification level of any information 
being transmitted. Also mark the transmittal document with an appropriate instruction such as 
placing the following on the face of the document: 


“Upon removal of attachment(s) this document is UNCLASSIFIED.” 


22. If the transmittal document itself contains classified information, mark it as required 
for all other classified information, including portion markings, classification authority block, 
and the full text, and: 


a. Mark the banner line of the transmittal document with the highest classification 
level of any information contained in the transmittal document or its enclosures. 


b. Mark the transmittal document with the appropriate instruction indicating its 
overall classification level if the level will change when the enclosures are removed (e.g., 
“Downgrade to CONFIDENTIAL when separated from SECRET enclosures” or “Handle 
as UNCLASSIFIED//FOR OFFICIAL USE ONLY on removal of attachments”). 


23. When an electronic document contains a file attachment or other embedded 
information, that document is considered a transmittal document for classification purposes. The 
overall classification markings for the electronic document should reflect the most restrictive 
markings of all embedded information. 


24. Additional classification marking guidance for NSA/CSS material may be found by 
typing “go class-mark” on NSA Web. 


Classification Marking in the Electronic Environment 
25. Classified national security information in the electronic environment shall be: 
a. Subject to all requirements of EO 13526 (Reference b); 


b. Marked with proper classification markings to the extent that such marking is 
practical; 


c. Marked with proper classification markings when appearing in an electronic 
output (e.g., database query); 


d. Marked in accordance with derivative classification procedures, maintaining 
traceability of classification decisions to the OCA; and 
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e. Prohibited from use as the source of the derivative classification if it is dynamic 
in nature (e.g., wikis and blogs) and where information is not marked in accordance with 
Reference b. 


26. Marking classified email messages. 


a. Classified email messages transmitted on or prepared for transmission on 
NSAWeb must display the overall classification at the top and bottom of the body of each 
message. The overall classification and control marking string for the email shall reflect 
the classification of the header and body of the message, including the subject line, the 
text of the email, the signature block, any attachments, any included message(s), and any 
other information that is conveyed in the email. The overall classification and control 
marking string shall follow the format: 


CLASSIFICATION: [classification and control marking string] 


b. Subject lines shall be portion marked to reflect the sensitivity of the 
information in the subject line. 


c. Classified email shall be portion marked to reflect the highest level of 
information contained in that portion. 


d. The signature block shall be portion marked to reflect the highest classification 
level and control of the information contained in the signature block itself. 


e. When forwarding or replying to an email, ensure required markings reflect the 
overall classification and control markings and classification authority block for the 
entire string of emails and attachments, including any newly drafted material received 
from previous senders and any attachments. 


27. Marking webpages with classified content. 


a. Webpages shall be classified and marked on their own content regardless of the 
classification of the pages to which they link. In general, the following guidelines apply: 


1) The banner line for every webpage shall reflect the overall 
classification and control marking(s) for the information on that page. Linear text 
entered at the top and bottom of the page is acceptable. NSA/CSS web standards 
for classification banners, as well as the code for inserting banners, are available 
on NSAWeb by typing “go class banner” in the web browser. 


2) Webpages containing no classified content shall include banners 
marked UNCLASSIFIED or UNCLASSIFIED//FOR OFFICIAL USE ONLY, as 
appropriate. 


3) All content on classified webpages shall be portion marked, including 


any point of contact information present on the page. Additionally, classified 
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webpages shall include the classification authority block at the bottom of the 
page. 


4) Electronic media files (e.g., video, audio, images, or slides) shall carry 
the overall classification of the information in a file and the classification 
authority block unless the addition of such information would render them 
inoperable. 


b. A dynamic page contains information derived from a changeable source or ad 


hoc query, such as a database. The classification and control marking(s) for the 
information returned may vary depending on the specific request. 


1) If there is a mechanism for determining the actual classification and 
control marking(s) for each response, then those shall be displayed in the 
response. If such a mechanism does not exist, then the following marking shall be 
used: 


DYNAMIC PAGE - HIGHEST POSSIBLE CLASSIFICATION IS 
[insert classification] 


2) The dynamic page marking shall appear on a webpage above the 
primary classification and control marking string with the highest possible overall 
classification and control marking(s) for information that can be retrieved. For 
example: 


DYNAMIC PAGE - HIGHEST POSSIBLE CLASSIFICATION IS 
TOP SECRET//SI//REL TO USA, AUS, CAN, GBR, NZL 


3) The combination of the dynamic marking and the classification and 
control marking string informs the viewer of the highest level of information that 
may appear, although the classification and control marking(s) for any particular 
information retrieved may be lower. This banner can be found with other 
approved classification banners (“go class-banner’’). 


c. Classified Blogs and Wikis 


1) The overall classification and control marking string for blog entries or 
wiki articles shall reflect the overall classification markings for the highest level 
of information allowed in that space. While the content of an overall blog is 
dynamic, entries are generally static in nature. Blog entries or comments and wiki 
articles or submissions shall be portion marked to reflect the highest level of 
information contained in that portion, not the content of the post. 


d. Controlled Imports 


1) Users may see unclassified pages that have been authorized for import 
from an external source (such as the Internet or a CD-ROM). Such pages shall 
carry the marking: 
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UNCLASSIFIED — CONTROLLED IMPORT FROM AN 
EXTERNAL SOURCE 


2) This marking was created to identify information that is unclassified 
when imported from an external source but might be protected if associated with 
NSA/CSS. This banner can be found with other approved classification banners 


(“go class-banner’”). 


3) Completely UNCLASSIFIED imported documents in a format that 
does not allow for editing (e.g., PDF) may be hosted on NSAWeb in their native 
form without the otherwise-required banner. 


28. Classified computer media such as USB sticks, hard drives, CD ROMs, and diskettes 
shall be marked to indicate the highest overall classification of the information contained within 
the media and a classification authority block, if applicable. 


Markings on Declassified Information 


29. Declassification markings shall be uniformly and conspicuously applied to 
information to leave no doubt about the declassified status of the information and who authorized 
the declassification. 


30. Apply the following markings to records, or copies of records, regardless of media: 
a. The word “Declassified;” 


b. The identity of the declassification authority, by name and position, or by 
personal identifier, or the title and date of the declassification guide. If the identity of the 
declassification authority must be protected, a personal identifier may be used or the 
information may be retained in Agency files; 


c. The date of declassification; and 


d. The overall classification markings that appear on the cover page or first page 
shall be lined with an “X” or straight line. An example might appear as: 


SECRET 
Declassified by David Smith, NSA/CSS Chief Information Officer 
on August 17, 2008 


Marking Compilations 


31. When marking materials for which the compilation principle applies, portions shall 
be marked to reflect only the information contained within that portion. The overall classification 
and control marking string shall reflect the highest classification and most restrictive control 
marking(s) applicable to the information revealed by the compilation of information. 
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32. A clear explanation for the classification as a result of compilation shall be provided 
to explain the relationship between the portion marking(s) and the overall classification and 
control marking string. The explanation shall be portion marked as needed and placed at the 
bottom of the first page of the document or the end of a soft copy file, for example: 


(U) “This document is classified [fill in classification and control marking(s)| 
because of the compilation of information.” 
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APPENDIX 1 TO ANNEX A 
IC CLASSIFICATION AND CONTROL MARKINGS 


1. The DNI maintains oversight of the IC classification management and control 
markings system, which provides the framework for accessing, classifying, disseminating, and 
declassifying intelligence and intelligence-related information to protect sources, methods, and 
activities (See Reference d). 


2. In accordance with DNI policies, a classification and control marking shall be applied 
to intelligence information only when the information requires protection from unauthorized 
disclosure and could reasonably be expected to cause identifiable or describable damage to 
national security. The proper application and use of classification and control markings enables 
information sharing while allowing the information to be properly safeguarded from inadvertent 
or unauthorized disclosure. The IC classification and control markings system is implemented 
and maintained through the IC Markings System Register and Manual (Reference e). 


Foreign Disclosure Release Markings 


3. NOFORN is an explicit foreign release marking used to indicate the information may 
not be released in any form to foreign governments, foreign nationals, foreign organizations, or 
non-U.S. citizens without permission of the originator and in accordance with provisions of the 
“Intelligence Community Markings System Register and Manual” (Reference e), ICD 403, 
“Foreign Disclosure and Release of Classified National Intelligence” (Reference u), ICPG 
710.2/403.5, “Application of Dissemination Controls: Foreign Disclosure and Release Markings” 
(Reference v), Director of Central Intelligence Directive 6/7, “Intelligence Disclosure Policy, 
(Reference w)” and NDP-1 (Reference x). 


4. REL TO is an explicit foreign release marking used to indicate the information has 
been predetermined by the originator to be releasable or has been released to the foreign 
country(ies)/international organization(s) indicated, through established foreign disclosure 
procedures and channels, and implementation guidance in Reference e and v. It is NOFORN to 
all other foreign country(ies)/international organization(s) not indicated in the REL TO marking. 
Per ICD 403 (Reference u), release is defined as the provision of classified intelligence, in 
writing or in any other medium, to authorized foreign recipients for retention. See Reference e 
and v for detailed guidance on the use of the REL TO marking. 


5. RELIDO (i.e., Releasable by Information Disclosure Official) is a permissive foreign 
release marking used on information to indicate that the originator has authorized a Senior 
Foreign Disclosure and Release Authority (SFDRA) to make further sharing decisions for 
uncaveated intelligence material (intelligence with no restrictive dissemination controls) in 
accordance with the existing procedures, guidelines, and implementation guidance in Reference 
e and v. 


6. DISPLAY ONLY is used to indicate the information is authorized for disclosure 
without providing the foreign recipient with a physical copy for retention, regardless of medium 
to the foreign country(ies)/international organization(s) indicated, through established foreign 
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disclosure procedures and channels, and implementation guidance in Reference e and v. Per ICD 
403 (Reference u), disclosure is defined as displaying or revealing classified intelligence whether 
orally, in writing, or in any other medium to an authorized foreign recipient without providing 
the foreign recipient a copy of such information for retention. 


7. To facilitate the appropriate foreign disclosure and release of intelligence information, 
the following applies: 


a. Originators shall explicitly mark classified disseminated analytic products with 
a foreign disclosure or release marking (1.e., NOFORN, REL TO, RELIDO, or DISPLAY 
ONLY); 


b. Originators are encouraged to apply appropriate foreign disclosure markings as 
soon as practicable; 


c. Classified disseminated analytic products that bear no explicit foreign 
disclosure or release marking shall: 


d. If created on or after 28 June 2010, be handled in the same manner as those 
documents that bear the Releasable by Information Disclosure Officer (RELIDO) 
marking; or 


e. If created prior to 28 June 2010, require an affirmative decision made by the 
originating agency’s Senior Foreign Disclosure and Release Authority for foreign 
disclosure or release; 


8. Other intelligence information that bears no explicit foreign disclosure or release 
marking shall be handled in accordance with the terms under which that information was made 
available. When possible, those terms should indicate the appropriate foreign disclosure or 
release marking; and 


9. Foreign disclosure or release decisions shall be consistent with ICD 403 (Reference u). 


10. NSA/CSS may establish internal, administrative, and element-specific control 
markings for use on classified and unclassified intelligence information to meet unique mission 
needs. Such controls shall be consistent with existing policies and guidance and not be 
duplicative of any markings in the IC Markings System Register and Manual (Reference e). 
NSA/CSS specific internal controls shall not be used when information is disseminated outside 
the Agency. 


11. NSA/CSS may apply caveats or warnings to communicate distribution or handling 
instructions for intelligence information; however, these caveats may not restrict dissemination 
beyond the restrictions already imposed by authorized control markings and must be consistent 
with any and all dissemination controls. 


12. Controls on the dissemination and use of classified national intelligence are necessary 
to protect intelligence sources, methods, and activities. Use of the originator control (ORCON) 
dissemination control marking enables the originator to maintain knowledge, supervision, and 
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control of the distribution of ORCON information beyond its original dissemination. Further 
dissemination of ORCON information requires advance permission from the originator. The 
ORCON marking shall be applied to ensure that classified national intelligence is disseminated 
appropriately without undue delay or restriction. ICPG 710.1 (Reference y) provides direction 
and guidance for the application and use of the ORCON dissemination control marking. 


13. Detailed guidance for marking information acquired under Foreign Intelligence 
Surveillance Act (FISA) authorities may be found in NSA CDO Directive 2016-001 (Reference 
z), ISS/RPG-019-14 (Reference aa), and ISS/RPG-034-14 (Reference bb). 


Control Marking Challenges 


14. NSA/CSS control marking challenge procedures are established in accordance with 
ICD 710 and DNI Guidance for Intelligence Community Marking Challenges (NCIX 260-11) 
(References d and cc). Authorized holders of information who, in good faith, believe that its 
control marking is improper (e.g., the banner is marked SECRET//SI/TK//NOFORN but the 
holder believes it should be marked SECRET//SI//NOFORN) are encouraged and expected to 
challenge the control marking status of the information. 


15. No punitive action will be taken against an authorized holder who, in good faith, 
makes a control marking challenge. 


16. Information involved in a control marking challenge shall continue to be protected at 
the level of its current classification level until a final decision is made on the challenge. 


a. Procedures for a Control Marking Challenge 
1) Informal Control Marking Challenges. 


a) Authorized holders of information may first seek resolution of a 
control marking challenge with the originator of the information. 


b) If the originator cannot be determined or is unavailable, of if the 
challenger is not satisfied with the originator’s response, challengers shall 
contact the originator’s local CAO to request a review. While the CAO 
cannot overturn an OCA decision, the CAO may assist in deciding 
whether it is advisable to further pursue a challenge. The list of NSA/CSS 
CAOs is available by typing “go cao” on NSA Web. 


c) If the CAO’s assistance does not resolve the challenger’s 
concern, the originator or the CAO shall contact the Classification Review 
Team in P131 (dl class review) for a determination. 


d) If the matter is not resolved, the challenger may submit a formal 
challenge in writing to the Chief, PIPE. 


2) Formal Control Marking Challenges. In addition to the guidelines 
above, formal control marking challenge procedures include: 
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a) The authorized holder shall present the challenge, in writing, to 
the Chief, PIPE. The formal challenge need not be any more specific than 
to question the control marking and provide a rationale. 


b) The Chief, PIPE shall provide an initial written response to a 
challenge within 60 days. 


c) If the Chief, PIPE is unable to review the challenge and respond 
within 60 days, the Agency must acknowledge the challenge in writing 
and provide the challenger with a date by which such a determination will 
be made. The acknowledgement shall also include a statement that, if no 
response is received within 120 days from the original notification, the 
challenger has the right to forward the challenge, in writing, to the Office 
of the National Counterintelligence Executive Special Security Directorate 
(ONCIX/SSD) for a decision. 


d) If the Chief, PIPE issues an adverse determination of a control 
marking challenge, the determination shall include notification that the 
challenger has the right to submit an appeal, in writing, to the 
ONCIX/SSD. 


17. Control Marking Challenge Appeals: Authorized holders of information who 
continue to question the formal control marking challenge determination may submit an appeal 
to the ONCIX/SSD in accordance with NCIX (National Counterintelligence Executive)-260-11 
(Reference cc). 


Portion Marking Waivers 


18. In accordance with References c, e, and f, only the Director of the ISOO may grant 
waivers to marking requirements specified by EO 13526 (Reference b) for classified 
information. Approved portion marking waivers will be temporary and will have specific 
expiration dates. 


19. Any NSA/CSS marking waiver request, including portion marking waiver requests, 
must be submitted by the SAO (i.e., Chief, PIPE) to the Controlled Access Program 
Coordination Office (CAPCO), for forwarding to the Director, ISOO. Notices of approved 
portion marking waivers are maintained by the Policy, Information, Performance, and Exports 
Group (P1). 


20. A waiver request shall include the reasons that the benefits of portion marking are 
outweighed by other factors, and the request must also demonstrate that the requested waiver 
will not create impediments to information sharing. 


21. A document not portion marked based on an ISOO-approved waiver must: 


a. Not be used as a source for derivative classification, nor can it be used as a 
source for preparers of classification guides. 
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b. Contain a caveat that states, “WARNING: THIS DOCUMENT CANNOT BE 
USED AS A SOURCE OF DERIVATIVE CLASSIFICATION.” 


c. Be portion marked when transmitted or disseminated outside the NSA/CSS, 
unless the ISOO waiver approval explicitly provides otherwise. 
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APPENDIX 2 TO ANNEX A 
DOD CLASSIFICATION AND CONTROL MARKINGS 


1. The DoD maintains oversight of the DoD Information Security Program, which 
provides procedures for the designation, marking, protection, and dissemination of CUI and 
classified military information. The proper application and use of DoD classification and control 
markings enables the identification and protection of national security information and promotes 
information sharing. 


2. Classified military information falls under the purview of DoD. Per the National 
Disclosure Policy (NDP-1) (Reference x), classified military information is military information 
requiring protection in the interest of national security and is limited to three classifications: TOP 
SECRET, SECRET, and CONFIDENTIAL. Classified military information is further subdivided 
into eight categories: 

a. Organization, Training and Employment of Military Forces 
b. Military Materiel and Munitions 
c. Applied Research and Development Information and Materiel 
d. Production Information 
e. Combined Military Operations, Planning and Readiness 
f. U.S. Order of Battle 
g. North American Defense 
h. Military Intelligence 
Foreign Disclosure Release Markings 


3. Authorized for Release To (REL TO): 


a. The AUTHORIZED TO RELEASE TO or REL TO control marking is 
authorized for use on all classified military information that has been determined by an 
authorized disclosure official to be releasable, or that has been released through 
established foreign disclosure procedures and channels, to the foreign country and/or 
international organization indicated. 


b. For documents containing REL TO portions, if the document is not fully 
releasable to at least one country other than U.S. or an international organization, the 
banner line shall not contain the REL TO marking. 


4. Not Releasable To Foreign Nationals (NOFORN): NOFORN shall not be applied to 
non-intelligence information, except for Naval Nuclear Propulsion Information and NDP-1 
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(Reference x), which have authorized exceptions for use of NOFORN. In all other instances, 
within the DoD NOFORN shall be used only on intelligence information. 


5. Detailed guidance for marking classified military information is contained in DoDM 
5200.01, Volume 2 (Reference f). 


6. DoD instructions for developing security classification guides can be found in DoDM 


5200.45 (Reference dd). 
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ANNEX B 
DOCUMENTING ORIGINAL CLASSIFICATION DECISIONS 


1. EO 13526 (Reference b) mandates all agencies with original classification authority 
prepare classification guides to facilitate the proper and uniform derivative classification of 
information. Classification guides document original classification decisions and must be 
approved by an OCA with purview over the information. Classification guidance is required for 
every topic (e.g., a system, plan, program, project, operation, or equipment) under the purview of 
NSA/CSS that is classified and not covered by an existing OCA decision. Classification guides 
may include items that are determined to be unclassified or CUI. 


2. A declassification guide documents both the elements of information on a specific 
subject that may be declassified and the elements that must remain classified. Declassification 
guides must also be approved in writing by an OCA with purview over the information. The 
“NSA/CSS Declassification Guide” (Reference ee) provides guidance on NSA/CSS information 
that may remain classified after 25 years. 


3. An Information Management Instruction (IMI), which is unique to NSA/CSS and is 
similar to a classification guide, documents decisions that are either all UNCLASSIFIED or 
UNCLASSIFIED//FOR OFFICIAL USE ONLY. Like classification and declassification guides, 
IMIs are approved in writing by an OCA with purview over the information. 


4. NSA/CSS classification guides, declassification guides, and IMIs, unless special 
access is required, will be maintained on NSAWeb (“go classguides”’) and selected ones are also 
available on SIPRNet at: 


https://intelshare.intelink.sgov.gov/sites/nsaclassguidesipr/SitePages/Home.aspx. 


5. Classification guides, declassification guides, and IMIs are categorized based on the 
type of information they describe, consistent with the NSA/CSS corporate policy structure: 


a. Series 01—Corporate, Management, Governance 
b. Series O2—SIGINT 

c. Series 03—Information Assurance 

d. Series 04—Human Resources 

e. Series 05—Security 

f. Series 06—Information Technology 

g. Series 07—Finance 


h. Series O8—Acquisition 
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i. Series 09—Installations and Logistics 
j. Series 10—Miscellaneous 
k. Series 11—Mission Integration and Cyber 


6. This Manual and its associated classification guides, declassification guides, and IMIs 
pertain only to information under the purview of the NSA/CSS Cryptologic Enterprise. The 
guidance herein cannot be used to classify information that belongs to other IC or DoD elements. 
Derivative classifiers should follow the classification guidance of the pertinent IC agency or 
DoD component when considering the proper handling or classification levels of that 
information. 


7. A classification guide must be reissued, cancelled, or certified current within 5 years of 
its publication. If not, the guide will expire effective 10 years from its issue date and will be 
removed from the NSA/CSS classification guide webpages on NSAWeb and SIPRNet. 


8. Changes to classification guides, declassification guides, and IMIs will be incorporated 
as necessary to keep them current and relevant through the use of a change register. Users are 
encouraged to assist in improving and maintaining NSA/CSS classification guidance. Requests 
for changes should be forwarded through appropriate organizational staff levels to P131. P131 is 
responsible for maintaining classification guidance in conjunction with a specific guide’s 
information owner. Requests for change will receive official vetting through all stakeholders. 
Program managers should be aware that the information that needs protection may change as a 
system, plan, program, project, or mission progresses through its life cycle. What needs to be 
classified in the early stages of a system, plan, program, project, or mission (e.g., during research 
and development) may differ from that which requires classification in other life-cycle phases 
(e.g., system development, production, operations, or execution). The classification guidance 
must be regularly reevaluated to determine updates as appropriate. 


9. Portions of the classification guides, declassification guides, and IMIs may be 
extracted or reproduced by authorized users for local use. Users must strictly adhere to all 
classification and handling restrictions when storing hard- or soft-copies of NSA/CSS guides or 
when hyperlinking to NSA/CSS guides. However, such reproductions are unofficial documents 
and over time may no longer reflect the most current guidance. Derivative classifiers are 
responsible for ensuring that they are basing their decisions on the most current classification 
guidance. See guidance on NSAWeb (“go class guides”) or SIPRNet. 


10. NSA/CSS classification guides, declassification guides, and IMIs are not releasable to 
any Third Party partner without prior approval from the Chief, Information Security/ 
Classification (P131). 


11. NSA/CSS Cryptologic Enterprise contractors or consultants assigned to NSA/CSS 
Headquarters or to other elements of the NSA/CSS Extended Enterprise are pre-authorized for 
access to NSA/CSS classification guides, declassification guides, and IMIs via NSAWeb, 
SIPRNet, or in hard-copy formats as needed to perform their jobs. Non NSA/CSS Cryptologic 
Enterprise contractors or consultants working at external facilities are pre-authorized for soft- 


B-2 
UNCLASSIFIED 


592 


UNCLASSIFIED 
Annex B to Policy Manual 1-52 8 January 2021 


copy access to NSA/CSS classification guidance via NSAWeb or SIPRNet, if connectivity to 
those systems is allowed by the contractor’s sponsor. Where such connectivity is not established, 
any hard-copy provision of NSA/CSS classification guidance must be authorized by the Chief, 
Information Security/Classification (P131). 


12. Further dissemination of NSA/CSS classification guides, declassification guides, and 
IMIs, including posting on networks other than NsAWeb or SIPRNet, is not authorized without 
prior approval from the Chief, Information Security/Classification (P131). 


13. Further information on creating classification guides and IMIs can be found on the 
P131 Developing Classification Guides webpage by typing “go develop-class-guides” on 
NSAWeb. Information on sanitization can be found on the Dissemination Guidance and 
Production Services reporting page. 
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(13 GlobalSecurity.org 


Home Military Agencies Navy PACFLT NAVAIRPAC PATRECONFORPAC 


Enter Search Term Mivitary 


Military 

— Special Projects Patrol Squadron TWO [VPU-2] 

— "Wizards" Equipment 
Intelligence a P-3B/C REEF POINT 


Patrol Squadron Special Projects Unit (VPU) 2 was established on 01 July 
1982, and was redesignated to Special Projects Patrol Squadron (VPU) 2 on 14 
April 1998. VPU-2 operates from numerous detachment sites throughout the 
Pacific and Indian Oceans. It was originally established as a small cadre of 
personnel assigned to squadrons, with the mission of supplementing aircrews 
on special collection missions. However, its manning and responsibilities 
expanded during the 1970s. In light of its unique mission capabilities and responsibilities, it was 
commissioned as an independent unit in July 1982. 


Homeland Security 


Space Homeport 


= MCBH Kaneohe Bay 


Official Homepage 
a Special Projects Patrol Squadron TWO 


Cmdr. Jeffrey S. Locke was relieved by Cmdr. Gregory D. Osborne as Commanding Officer of Special Projects Patrol Squadron Two (VPU- 
2), at Naval Air Station Barbers Point on 05 March 1999. During his tenure as Commanding Officer and Executive Officer, Locke's leadership 
was responsible for the flawless execution of 12 forward deployed detachments, totaling more than 300 events and 2,400 flight hours and 
achieving superb results in support of Joint Chiefs of Staff and Fleet Commander tasking. He directed the installation of 12 major aircraft 
sensor upgrades totaling $3.2 million, ensuring mission aircraft kept pace with evolving technology. His flawless planning and execution of 
initial operational test and evaluation of the prototype Tactical Common Data Link and Fiber Optic Bus Multiplexing system laid the 
foundation for future installation in Navy aircraft. His uncompromising ‘safety first’ command climate resulted in the squadron achieving more 
than 40,000 consecutive mishap-free flight hours during a 16-year period. Locke also effectively increased the squadron's mission capable 
rate by 11 percent, flight hours by 12 percent and achieved ‘outstanding’ results during the Type Wing Material Condition Inspection and 
Commander, Naval Air Force, U.S. Pacific Fleet Aviation Maintenance Evaluation. These accomplishments earned him his second 
Meritorious Service Medal. 


Despite operational commitments, the squadron completed an early 1999 homeport change from Naval Air Station 
Barbers Point to Marine Corps Base Hawaii, Kaneohe Bay, and hastened to complete the move ahead of schedule so 
it could deploy a week later to support the NATO air campaign in Kosovo. 


In early 2000 Cmdr. Irving G. Bough relieved Cmdr. Gregory D. Osborne as "Wizard One", Commanding Officer of 
Special Projects Patrol Squadron Two, Marine Corps Base Hawaii, Kaneohe Bay in a ceremony held in the squadron 
hangar. Osborne took command of VPU-2 in March 1999. During the year, VPU-2 deployed aircrews around the world in support of theater, 
Commander in Chief and Joint Chiefs of Staff tasking. VPU-2 received the "Battle E" for 1999, the Navy award given to the best command 
within a given community for the year. 
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